TinyPHPForum 3.6 and earlier stores the (1) users/USERNAME.hash and (2) users/USERNAME.email files under the web root with insufficient access control which allows remote attackers to list all registered users and possibly obtain other sensitive information.