A flaw was found in Red Hat Quay's exported logs feature. The /exportedlogs/<file_id> endpoint at endpoints/web.py:411 has no authentication decorator, allowing any caller with a valid file ID to download exported action logs without authentication. While the file ID is 256 bits (two UUID4s) making blind enumeration infeasible, the ID is delivered via plaintext email and webhook callbacks, creating interception opportunities. On cloud storage backends the download URL expires in 1 hour, but on LocalStorage backends exported log files persist indefinitely and the unauthenticated endpoint serves them with no time limit. Exported logs contain usernames, email addresses, IP addresses, action types, and action-specific metadata.