Improper Access Control allows OTP bypass

By directly navigating to the Admin Log download endpoint, the OTP requirement being sent to the user's email could be bypassed and users within the organization could access Admin Logs without verifying their identity. We thank @kongwenbin for reporting this to our team and confirming its resolution.