I'm currently svn updated upto r79552.

The following urls display different results:

• http://localhost/w/api.php?action=query&list=allusers&auprop=rights
• http://localhost/w/api.php?action=query&list=users&usprop=rights&ususers=Root

auprop=groups

• Lists all rights (good)
  
  <u name="Root" userid="1"> <rights> <r>createaccount</r> <r>read</r> <r>edit</r> <r>createpage</r> <r>createtalk</r> <r>writeapi</r> <r>move</r> <r>move-subpages</r> <r>move-rootuserpages</r> <r>upload</r> <r>reupload</r> <r>reupload-shared</r> <r>minoredit</r> <r>purge</r> <r>sendemail</r> <r>autoconfirmed</r> <r>userrights</r> <r>noratelimit</r> <r>block</r> <r>delete</r> <r>bigdelete</r> <r>deletedhistory</r> <r>deletedtext</r> <r>undelete</r> <r>editinterface</r> <r>editusercss</r> <r>edituserjs</r> <r>import</r> <r>importupload</r> <r>patrol</r> <r>autopatrol</r> <r>protect</r> <r>proxyunbannable</r> <r>rollback</r> <r>trackback</r> <r>unwatchedpages</r> <r>upload_by_url</r> <r>ipblock-exempt</r> <r>blockemail</r> <r>markbotedits</r> <r>apihighlimits</r> <r>browsearchive</r> <r>movefile</r> <r>unblockself</r> <r>suppressredirect</r> </rights> </u>

usprop=groups

• Only lists rights that everybody has by default (bad)
  
  <user name="Root"> <rights> <r>createaccount</r> <r>read</r> <r>edit</r> <r>createpage</r> <r>createtalk</r> <r>writeapi</r> <r>move</r> <r>move-subpages</r> <r>move-rootuserpages</r> <r>upload</r> <r>reupload</r> <r>reupload-shared</r> <r>minoredit</r> <r>purge</r> <r>sendemail</r> <r>autoconfirmed</r> </rights> </user>

Version: 1.18.x
Severity: major