Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses

Summary

A security researcher identified an unauthenticated JSON API endpoint that exposed sensitive user information including internal UUIDs, display names, and corporate email addresses. The endpoint returned privileged account details such as administrative roles without requiring authentication, enabling user enumeration and potential targeted attacks. The vulnerability was classified as CWE-200 (Information Disclosure) with a Medium severity rating (CVSS 4.6). The issue was successfully remediated through implementation of proper authentication controls and data minimization practices. We appreciate the researcher's responsible disclosure, which helped strengthen our security posture and protect user information from unauthorized access.