fix: don't expose user existence if visitor can't view users

resolves NodeBB#12432

src/middleware/index.js

@@ -174,7 +174,7 @@ async function expose(exposedField, method, field, req, res, next) {
 	}
 	const value = await method(String(req.params[field]).toLowerCase());
 	if (!value) {
-		next('route');
+		middleware.canViewUsers(req, res, () => next('route'));
 		return;
 	}