Summary

When a non-admin user access JIRA and directly hit the URL (assuming that he knows other users' username), he would be able to view his/her profile though no Browse User permission is granted.

Steps to Reproduce

1. Create a test user and grant an application access
2. Ensure that no Browse User permission is granted to this user
3. Access the Base URL and append secure/ViewProfile.jspa?name=anyusername at the end of the Base URL.

Expected Behavior

User is not able to view the profile.

Actual Result

User is able to see the other user's profile as long as he knows the username.

Workaround

None