Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some resource.
If permissions are viewable, that gives an attacker a list of valid usernames and tells the attacker which accounts are the best candidates to attack. An attacker is much more likely to want to break in to the
Making permissions viewable also makes it much more likely that other security shortcomings are going to be exploited. If someone forgot to remove the
Of course, the attacker still has to craft an appropriate attack-- whether technical or social-- to exploit the information they get from being able to view other users' privileges. It just makes it quicker, easier, and safer to mount the attack if you know where the pressure points are.