Role-membership listing is an administrative function that returns the users assigned to a specific role or group. It is common in identity and access management systems for auditing, support, and access reviews, because administrators often need to confirm who can use a given permission set.
In security terms, this kind of lookup can become sensitive very quickly. If an endpoint only checks whether the caller can reach the API, but does not verify access to each returned user record, it can leak usernames, email addresses, and internal relationships between users and roles. Attackers value that information for reconnaissance, targeted phishing, and mapping privileged accounts. Defenders should enforce object-level authorization, return only the minimum data needed, and log membership queries so unusual enumeration can be detected.