The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the βaccess user profilesβ permission to access arbitrary usersβ emails via vectors related to the βuser index methodβ and βthe path to the user resource.β