A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.
CWE-359