The REST API doesn't mask private information such as passwords or email addresses

A user that has view rights on a user page (i.e. everybody including guest) can access to the objects associated to the page (i.e., XWiki.XWikiUsers) and see the values of their field as they are (i.e., the email address or the password hash)