Confluence will display all users registered on it when users access any user picker or user lister macro and use * value as its search parameter.

This is not a good implementation from security point of view as normal users would be able to see the whole users. It would be better if we could provide a configuration where administrator of Confluence could restrict the listed users.