It is possible for an anonymous user to get a full list of user locks.
This has been fixed in FileCloud Version 19.3 and later. FileCloud now requires that users who request a list of locks have a valid account.
If you are using FileCloud on premise installation, please update to the latest version.
If you are using FileCloud online, your site has already been updated to the latest version.