- Severity: LOW
- Ecosystems: go
- Packages: github.com/basekick-labs/arc
## Summary
Arc exposes `GET /api/v1/logs` without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.
## Details
Arc applies the global auth middleware after calling `server.RegisterRoutes()`:
– `cmd/arc/main.go:1598-1599` registers base routes via `server.RegisterRoutes()`.
– `cmd/arc/main.go:1601-1618` configures and installs `auth.NewMiddleware(…)` later.
`server.RegisterRoutes()` registers `GET /api/v1/logs` as a base route:
– `internal/api/server.go:164-183` registers base health, metrics, and logs routes, including `s.app.Get(“/api/v1/logs”, s.logsHandler)`.
The logs handler returns buffered logs without checking authentication or authorization:
– `internal/api/server.go:537-567` parses `limit`, `level`, and `since_minutes`, reads `logger.GetBuffer().GetRecent(…)`, and returns JSON.
– `internal/logger/buffer.go:9-16` defines log entries returned to callers: timestamp, level, component, message, and caller.
– `internal/logger/buffer.go:33-39` creates a global log buffer holding the last 10,000 entries.
– `internal/api/server.go:540-558` permits up to `limit=1000` and `since_minutes=1440` in one unauthenticated request.
Authentication is enabled by default and `/api/v1/logs` is not listed as a public route:
– `internal/config/config.go:841-843` defaults auth to enabled.…
Source: GitHub Security Advisories · 2026-11-03