An authenticated user without user-management permissions could identify other user accounts.
CWE-497