Emby Connect can obtain email address

[scheideggstrasse 0]

Hello,

I didn't find the right forum to post this - it's probably more a bug as a featuere:

I came across a potential "data breach" with emby connect.

If I add an user on my local emby server and enter the emby connect username, it shows me the mail of the user.

For example I added "ramer" and it showed me the mail "ramerbiggs417@gmail.com" - that shouldn't be the case from my point of view.
This way I could program a script with "dummy" usernames and get 100s of mails of emby users.

Cheers

[GrimReaper 4749]

Actually, linking via Connect usernames should be disbanded altogether and only emails used IMHO. 

Edited October 16, 2022 by GrimReaper
Typo

[visproduction 316]

I am not familar with Emby connect.  Isn't "Add user" an admin only function.  Admin person, in any web social network code, can see user's data and contact.  Make the users non-admin. Does that not stop them form being able to add users?  

Edited October 16, 2022 by visproduction

[Spaceboy 2573]

5 minutes ago, visproduction said:

I am not familar with Emby connect.  Isn't "Add user" an admin only function.  Admin person, in any web social network code, can see user's data and contact.  Make the users non-admin. Does that not stop them form being able to add users?  

emby allows adding of user accounts by use of the forum username. so for instance i can see your email address is a @cox.net one

[ebr 16187]

On 10/16/2022 at 11:10 AM, visproduction said:

Isn't "Add user" an admin only function.

Yes it is.

[ebr 16187]

On 10/16/2022 at 10:46 AM, GrimReaper said:

Actually, linking via Connect usernames should be disbanded altogether and only emails used IMHO. 

That is the plan but we needed a transition.