A missing authorization issue in a GraphQL private API operation within the Google App Engine section of the Cloud Console enables an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects by sending a specially crafted request.