A Missing Authorization vulnerability in a private GraphQL API operation of the Google App Engine section of the Cloud Console permits an unauthenticated remote attacker to retrieve request logs from other projects using a specially crafted request, thereby exposing potentially sensitive operational information and compromising confidentiality.

Google Cloud Console UIs, specifically the App Engine section accessed through the Cloud Console; any project that uses this UI without the April 7 2026 patch is affected.

The CVSS score of 6.9 indicates moderate severity. Exploitation is possible remotely without authentication, targeting the GraphQL endpoint exposed by the Console UI. The vulnerability is not listed in CISA’s KEV catalog and has no EPSS score, so a precise exploitation probability cannot be determined; however, the lack of an official KEV listing and the absence of an EPSS value imply a lower risk compared to actively exploited weaknesses. The issue was patched on 7 April 2026, so the effective risk window has closed and no further action is required by customers.