Threats tagged 'ghsa-m3qr-fvp4-78xj'

Arc exposes an unauthenticated endpoint at GET /api/v1/logs that returns recent application logs without requiring authentication, despite authentication being enabled by default. This occurs because the route is registered before the global authentication middleware, causing the middleware to be bypassed. The logs can include operational metadata and potentially sensitive information, which could aid attackers. A fix is available that involves reordering route registration or adding explicit authentication checks.