Editors/LogViewerController.cs in Umbraco up to and including 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
umbraco umbraco cms