How Unauthenticated Queries Exposed User PII and Privileged Accounts

Unauthenticated API queries exposed sensitive user data and enabled enumeration of the application’s entire observed userbase.