I couldn't find any other post on stack exchange talking about this.

I have found a way to get a website to list all users and their names. Is this considered a vulnerability? This website does have a bug bounty.

I think this might be a vulnerability, because an attacker could enumerate the user list and test the top 3 passwords or something, then switch to another proxy and try the next account. I don't know if this is worth reporting or not, however.

So here are my questions: Is this a vulnerability? What is its severity? Is it worth reporting? And if it is a vulnerability, what other ways could someone exploit this?

Edit: This question is talking about actually being able to list every single user and their names. Not just being able to check whether or not a user exists. I don't know how to "unmark" this as a duplicate.

  • this is definitely a vulnerability and worth reporting!
    – NtFreX
    Jun 2, 2017 at 18:20
  • 1
    We have tons of questions about username enumeration. E.g. this, this and this.
    – Arminius
    Jun 2, 2017 at 18:21
  • 1
    @Arminius arent those questions all about if its secure to show that a user exists after the username has been entered? This questions seems to be about a issue where he can list all users.
    – NtFreX
    Jun 2, 2017 at 19:06
  • @Dr.Fre In my opinion, the arguments in that case aren't fundamentally different. But if you think that's a separate issue that justifies an individual question, you might want to emphasize this aspect in the question and ask for a reopen.
    – Arminius
    Jun 2, 2017 at 19:39
  • 1
    Oh sorry, I just realized I was commenting from my second account. The @Arin user is me.
    – user149925
    Jun 3, 2017 at 23:01