Several endpoints use the authHandler() and authHandlerWithUser() middleware functions. When the authentication provider is set to the default ("openShiftAuth"), no verification of authentication is actually performed by these functions, leaving the authentication/authorization checks to be performed by the targeted service.
The following endpoints are using the aforementioned middleware functions without checking if the user provided valid credentials lead to various degrees of data exposure:

/api/console/monitoring-dashboard-config
/api/console/knative-event-sources
/api/console/knative-channels
/api/check-updates
/api/console/version
/api/copy-login-commands
/api/gitops
/api/plugins/
/api/metrics
/api/metrics/usage