Non privileged user has access to list of all users

Get Help
1

Hi,
I am currently evaluating Metabase as a multi-tenancy solution on a local Metabase instance, however I've discovered a weird behaviour in the API permissions in that a non-privileged user (non-superuser) account is able to access /api/user to get a list of all created accounts.

Is there a specific reason as to why such a user is able to get a list of all registered users?

this SS shows non-superuser

image
image1276×192 13.6 KB

this SS shows /api/user using the non-privileged users' access token

image
image809×649 19.4 KB

2

Hi @Jxperforml
It's used for Subscription autocomplete for users among other. You're interested in this:
Option for restricting pulse recipients to those in the same group · Issue #10795 · metabase/metabase · GitHub - upvote by clicking :+1: on the first post