I'm considering this one a relatively low priority because:
1. It's bruteforce user enumeration, which means you already have to have some idea of which ones are present.
2. There's already a much more direct user enumeration attack available in Mahara: https://bugs.launchpad.net/mahara/+bug/1158625
3. Because Mahara is a social network, usernames are not particularly secret to begin with.
I'm considering this one a relatively low priority because:
1. It's bruteforce user enumeration, which means you already have to have some idea of which ones are present. /bugs.launchpad .net/mahara/ +bug/1158625
2. There's already a much more direct user enumeration attack available in Mahara: https:/
3. Because Mahara is a social network, usernames are not particularly secret to begin with.