Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

Affected: Maven: org.yamcs:yamcs-core

### Summary

The IAM API endpoints (`listUsers`, `getUser`, `listGroups`, and `getGroup`) in `yamcs-core` do not enforce the required `SystemPrivilege.ControlAccess` check. As a result, **any authenticated user** (even those with low or no privileges) can enumerate all user accounts in the system, including their usernames, superuser status, and group memberships.

This constitutes a broken access control vulnerability (CWE-862) that leaks sensitive user information.

### Root Cause

**File:** `yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java:125,180,357,372`

`listUsers()`, `getUser()`, `listGroups()`, and `getGroup()` do not require `SystemPrivilege.ControlAccess`. Any authenticated user — regardless of privileges — can enumerate all users, their superuser status, and group memberships:

```java // listUsers — NO checkSystemPrivilege public void listUsers(Context ctx, Empty request, ...) { var sensitiveDetails = ctx.user.hasSystemPrivilege(SystemPrivilege.ControlAccess); // sensitiveDetails=false for low-priv users, but name/superuser/active still exposed for (User user : users) { UserInfo userb = toUserInfo(user, sensitiveDetails, directory); responseb.addUsers(userb); } } ```

Compare with properly protected endpoints:

```java // createUser — correctly protected public void createUser(Context ctx, ...) { ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess); // present ```

### Impact

Any authenticated user can:

1. List all…