An attacker who has obtained a file ID can download exported action logs from Red Hat Quay without authentication, revealing usernames, email addresses, IP addresses, and action‐specific metadata. The flaw resides in the exported logs functionality and embodies a CWE‑306 weakness, where missing authorization permits unauthorized data access. Consequently, confidential information may be exposed to anyone who intercepts or deduces a file ID.

The vulnerability affects Red Hat OpenShift Update Service and Red Hat Quay 3. No specific version numbers are disclosed in the advisory, so all installations of Quay 3 that have the exported logs feature enabled are potentially impacted.

The CVSS score of 5.9 indicates a moderate risk level, and the EPSS score is currently not available, suggesting limited publicly known exploitation data. The vulnerability is not listed in CISA's KEV catalog. Attacker likely needs to obtain a valid file ID, which can be captured from plaintext email or webhook callbacks, and then request the log file. The lack of authentication means that once the ID is known, downloading the log is trivial, leading to information disclosure.