Broken authorization extension API /users and /users/{user_id}

Can you take a look at this topic and see if it guides you to a solution?

It sounds like a similar issue.