[wp-trac] [WordPress Trac] #61143: Our rest api User listing has chances to reveal username of Administrator User "wp-json/wp/v2/users"

[WordPress Trac]

#61143: Our rest api User listing has chances to reveal username of Administrator
User "wp-json/wp/v2/users"
----------------------------+----------------------------------------------
 Reporter:  hlakkad1998     |      Owner:  (none)
     Type:  defect (bug)    |     Status:  new
 Priority:  normal          |  Milestone:  Awaiting Review
Component:  REST API        |    Version:  6.5
 Severity:  critical        |   Keywords:  needs-privacy-review needs-patch
  Focuses:  rest-api,       |
  privacy                   |
----------------------------+----------------------------------------------
 Whenever we create a setup in WordPress at that time We have to add a user
 name. So after the setup, we can log in to the admin panel with that new
 user. I know that in the API it shows the display name field. But in 90%
 of the cases, it takes the username as the display name. Admin users do
 not change this even after creating a new user. So when I hit
 "http://localhost/wordpress/security-check/wp-json/wp/v2/users" in my
 local setup, it shows me the admin user name (The display name is the same
 as the user name). When I did the setup of WordPress I created a user with
 "security-check-admin" this name and the same name I can see in the users
 API. I think this is a bad idea. I prefer that this API should not give
 any information about the administrator role. Even if you give the access
 user names should not be revealed like this. I am attaching some photos so
 you guys can check. I have tested this 6.5.2 version. Please look into
 this.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/61143>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform