account takeover on 3.0.1 version

How it was found

I find user reset password hash info and other security info on "/api/v1/users.info"
note : I login on rocketchat with ldap account (my role : user)
note: in request "https://target/api/v1/users.info?username=[x]" you should change usrname to userId

1- please login with user ldap account (role user)
2- send a request to https://target/api/v1/users.list and copy _id value
3- send a request to https://target/api/v1/users.info?userId=[userId] and copy email value (in response you can see important security information )
4- logout and click "forget your password" link on https://target/home and send an email to above email address that you copied
4- login with Your account and send a request to https://target/api/v1/users.list and search the same email in response and copy _id value
5- send a request to https://target/api/v1/users.info?userId=[userId] and copy reset hash value
6- logout your account and send a request to https://target/reset-password/[reset_hash]
7- set new password
8- login and enjoy

Impact

account takeover