An authenticated user without user-management permissions could view other users account information.
CWE-862