An information disclosure issue exists, allowing virtually any authenticated user to access any data, except password hashes, of any other authenticated user. This is due to the "users.list" REST endpoint processing a query parameter from JSON and executing Users.find(queryFromClientSide).