If user has any other role than student, then he is able to see all other users data through forged api request

[rokj]

MeetPlanBackend/httphandlers/user.go

Line 216 in c2a3d03

if jwt["role"] == "student" {

[rokj]

Also, any user can make /users/get request to backend where he can see all the users data.

Better than relying on json data in jwt, is to check for proper role of the user in db.