The NR developers did a really good job at restricting me from finding out info about other user accounts through the NR Synthetics settings - so far I haven't found a way to bypass it (yet 😉).
There exists another way to obtain this information about other user accounts, and it has to do with the notification channel settings within NR Alerts. It seems like the devs have forgotten to conceal the name of new users added to the account via the "channels" endpoint.
Proof is that I pulled the first+last name of the user account "firstname.lastname@example.org" (Note: In the future for these types of bugs, are you ok with me using this account as a proof of concept? Since I assume it isn't a customer and belongs to a member of New Relic, I'd rather pull data from this account rather than another NR customer.):
This information is concealed on the users page:
Steps to Reproduce:
1081322 is the User notification channel for the user "email@example.com"
Let me know if there's any other questions, thanks!
IDOR allows me to view names of other New Relic customers.