Unauthenticated account disclosure via persistent initialization endpoint

Information disclosure in TP-Link Omada Controllers allows remote attackers to enumerate administrative accounts through an initialization API. The controller leaves an API endpoint intended only for initial setup reachable after initialization and returns account-related data without authentication. No credentials or user interaction are required; the disclosed details support user enumeration and subsequent targeting of administrative accounts.