Currently the list-log-files and read-log-file operations will allow any file jboss.server.log.dir to be listed/viewed. Ideally only log files will be accessible, but ultimately audit logs need to definitely not be accessible.