The /1/api/ulisting-user/search REST route did not perform capability and CSRF checks, allowing unauthenticated users to get the list of all users and their email address.
2021-01-28 (about 2 years ago)
2021-01-28 (about 2 years ago)
2021-01-29 (about 2 years ago)