Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
CWE-639