A missing authorization check in Craft CMS allows any authenticated control panel user with only the base access permission to retrieve aggregate user registration metrics. The endpoint /actions/charts/get-new-users-data does not enforce the expected 'viewUsers' permission, exposing time-series counts of new user registrations by group and date. No personally identifiable information is disclosed, and the impact is limited to revealing user group sizes and registration trends.