Authenticated display-name disclosure via unchecked bulk actions

Information disclosure in affected Wagtail versions allows remote authenticated users to read account display names through admin URLs. The UserBulkAction view processes selected user objects without first enforcing add, change, or delete permissions, so its denial response renders their display names. Access to the Wagtail admin as a limited-permission editor is required; ordinary site visitors cannot reach the disclosure, and the response does not permit account changes.