FishEye provides account information to users regardless of permissions

How to reproduce:

1. Create user group 1
2. Create user account A as non-administrator
3. Assign user account A to group 1
4. Create user group 2
5. Create user account B as non-administrator
6. Assign user account B to group 2
7. Log in as A
8. Search for B in the search bar at the top of the screen

Results:
Full user account information.

Expected Result:
User account A would not find user account B