- Status: Fixed in 1.6.7
- Introduced in: 1.6.2
We were made aware that it was possible for an authenticated user to list all users in a Humio cluster using the GraphQL API.
This also applies to customers on our cloud services, where it would be possible to get a list of user email addresses.
We will take measures to avoid similar issues going forward.