The Apache Storm Logviewer provides 'logs.users' and 'logs.groups' settings to control log access. However, for daemon logs, these settings were not enforced because the access decision logic discarded the authorizer's result when the 'daemon log' flag was set. The daemon log page and download endpoints did not consult the authorizer at all, allowing any user passing the servlet filter to read sensitive daemon logs across all reachable nodes. Furthermore, the log listing endpoints '/listLogs' and '/searchLogs' accepted a user argument but did not apply it, returning metadata for all tenants' topology and worker logs regardless of the caller. This vulnerability exposes sensitive log content and metadata to unauthorized users. The issue was fixed in Apache Storm version 3.1.0 by enforcing user and group list checks on daemon log paths and filtering listing endpoints by the requesting user.

Unauthorized users who can pass the servlet filter may read daemon logs containing other tenants' topology names, owners, and configuration fragments. This exposure can lead to information disclosure of sensitive operational data across tenants. Metadata about all tenants' topology and worker log files is also exposed without restriction. There is no indication of active exploitation in the wild.

Upgrade Apache Storm Logviewer to version 3.1.0 or later, where daemon log paths enforce configured user and group access controls and listing endpoints filter results by the requesting user. For users unable to upgrade immediately, place the Logviewer behind a reverse proxy that restricts access to daemon log endpoints and treat daemon log content as accessible to any user authenticated by the servlet filter.