Authenticated user-data disclosure via unchecked API privilege

Improper privilege management in Deskpro before 2019.8.0 allows remote authenticated users to disclose registered users' sensitive data. The /api/people endpoint accepts a normal user's API-authenticated request without enforcing the privilege required to list people, returning names, roles, email addresses, and phone numbers. A valid low-privilege account and API token are required; the flaw exposes directory data but does not itself alter records or interrupt service.