Users configuration endpoint leaks other users' data to any logged-in user

The users configuration endpoint does not check that the requester owns the object they ask for, so a signed-in user can read data belonging to other users. The attacker gets information disclosure, not code execution or account takeover.

Summary written from the sources below. Check the originals before acting.