Compliance Impact

This vulnerability allows any authenticated user to read the full application log buffer without privilege checks, potentially exposing sensitive information contained in logs.

Such unauthorized access to sensitive log data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the '/logs' and '/logs-stream' endpoints of the log router. Any authenticated user can access these endpoints and read the full application log buffer.

The endpoints require only basic authentication (via 'get_current_active_user') and do not perform any privilege checks such as verifying if the user is a superuser.

Useful 0 Not Useful 0

Impact Analysis

Because any authenticated user can read the full application log buffer without privilege checks, sensitive information contained in the logs could be exposed to unauthorized users.

This could lead to information disclosure, potentially exposing confidential data or system details that could be leveraged for further attacks.

Useful 0 Not Useful 0