Does this api allow me to enumerate the users (by phone number) using the service? That would seem to be bad as well. I. guess that it depends on what their fix was.

If this really was the first api request made by the app, and it has a serious vulnerability, then the omens are not great for the rest of the api calls either.