Description
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request.
This vulnerability was patched on 7 April 2026, and no customer action is needed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Google Cloud | Cloud Console UIs | < 2026-04-07 | 2026-04-07 |
Advisories 1
- WID-SEC-2026-2032 Google Cloud Logging und Cloud Console App Engine: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 22, 2026