3. of Repudiation

A low-privilege attacker can read interesting security information in the logs.

Threat
	You don’t have any access control in place to restrict who can access the logs; permissions to access the logs should be the same as those required to view any of the information being logged.
CAPEC	CAPEC-180 - Exploiting Incorrectly Configured Access Control Security Levels
ASVS	7.1.1 - Ensure that secrets and payment card details including CVV numbers are not being logged. 7.1.2 - Ensure PII and other sensitive data being logged complies with regulations. 7.3.3 - Ensure logs are protected by strict access controls and that the entries are immutable.
CWE	CWE-921 - Storage of Sensitive Data in a...