The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The "tags.php" endpoint is affected, specifically the `edit list` parameter, which is not sanitized and is used to construct an SQL query to retrieve a list of registered users into the application.