Apache Rave returns the full user object, including the salted and hashed password, via the User RPC API. This endpoint is only available to authenticated users, but will return all User objects in the database given the correct query. Versions 0.11 through 0.20 are affected.
0fc0f4d0dcf747beda3059f5ac91c70414ea7169915d9f52f748260badb8a8b5