When using the autocomplete widget for the author field (or any entity reference field pointing to user entities), Drupal currently exposes users' names to any role that has access to use this widget, regardless of whether that role has the administer users permission. This creates a privacy concern because it allows editors or users with access to the field to discover other users' identities by typing into the autocomplete box. In some setups — like ours — the email is stored as the username, so the autocomplete effectively leaks personal identifiable information (PII). Malicious users could also scrape the endpoint behind the autocomplete and harvest user data.
access user autocomplete) which controls who can see results returned by user autocompletes.The name should also validate that it does not contain any email or sensitive information.
user.permissions.yml.hook_user_autocomplete_alter() to customize the results.None.
Autocomplete fields referencing user entities are now protected by a new permission Access user autocomplete. Users without this permission will no longer be able to discover usernames/emails through autocomplete suggestions. If your site relies on existing behavior, grant the permission to appropriate roles after upgrade.
Active
10.4 ✨
ajax system
As the user should assume that the name could be public, it should not be a risk, just a feature and something to take into account, and never use on a public field sensitive information like emails.
This looks like a duplicate of ✨ Entity reference autocomplete cause the user data leak Active . Can you verify?