# Security concerns on user enumeration

**URL:** <https://forum.ansible.com/t/security-concerns-on-user-enumeration/29359>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [January 3, 2019, 4:03pm UTC](https://forum.ansible.com/t/security-concerns-on-user-enumeration/29359 "2019-01-03T16:03:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zan](https://avatars.discourse-cdn.com/v4/letter/z/48db29/32.png) [@zan](https://forum.ansible.com/u/zan)\
**Post date:** [January 3, 2019, 4:03pm UTC](https://forum.ansible.com/t/security-concerns-on-user-enumeration/29359/1 "2019-01-03T16:03:19Z")

</div>

Right now the system allows a ‘Normal User’ of AWX to see all the other users including administrators of the system and their information. The user’s information or Id may be leveraged in attacks such as password spraying etc. Is there a way to limit the visibility of other user’s information and list depending on the user’s role in AWX? i.e only administrators should be able to see the full extensive list of all users of the system. I would appreciate any response on this matter.

---

<div class="post-metadata">

**Author:** ![Foley\_John](https://avatars.discourse-cdn.com/v4/letter/f/e495f1/32.png) [@Foley\_John](https://forum.ansible.com/u/Foley_John)\
**Post date:** [January 3, 2019, 4:33pm UTC](https://forum.ansible.com/t/security-concerns-on-user-enumeration/29359/2 "2019-01-03T16:33:55Z")

</div>

I believe you can see who is in your organization + admins, but you cannot see every single user of the system.

If you create a user with no organization assignments, that user can only see the admins.

I can understand the concern, but regular users cannot see EVERYONE on the system, as you stated.

Thanks,

John Foley

LOC

---

<div class="post-metadata">

**Author:** ![rpetrell](https://avatars.discourse-cdn.com/v4/letter/r/b4bc9f/32.png) [@rpetrell](https://forum.ansible.com/u/rpetrell)\
**Post date:** [January 3, 2019, 4:40pm UTC](https://forum.ansible.com/t/security-concerns-on-user-enumeration/29359/3 "2019-01-03T16:40:09Z")

</div>

In addition to this, Normal Users have the ability to delegate their resources (such as credentials they own) to other users. In order to do this, they need to be able to access the list of users in their team/organization.

---

<div class="post-metadata">

**Author:** ![zan](https://avatars.discourse-cdn.com/v4/letter/z/48db29/32.png) [@zan](https://forum.ansible.com/u/zan)\
**Post date:** [January 3, 2019, 5:57pm UTC](https://forum.ansible.com/t/security-concerns-on-user-enumeration/29359/4 "2019-01-03T17:57:02Z")

</div>

Thanks guys for your prompt responses. It makes sense now why the users are able to see information of other users from same team/organization.