Looks like a regression. Upstream PR: https://github.com/kubernetes/kubernetes/pull/67137

Will make it into Origin in the next rebase.

Upstream PR has merged. Fix will be available in Origin after the next rebase.

This has merged with the rebase, moving to qa.

The issue has fixed:
[root@dhcp-140-138 ~]# oc version --short
Client Version: v4.0.6
Server Version: v1.12.4+0cbcfc5afe
[root@dhcp-140-138 ~]# oc get users
Error from server (Forbidden): users.user.openshift.io is forbidden: User "pm1" cannot list resource "users" in API group "user.openshift.io" at the cluster scope
[root@dhcp-140-138 ~]# oc get users --loglevel=6
I0301 10:32:00.953222   15895 loader.go:359] Config loaded from file /root/.kube/config
I0301 10:32:00.954370   15895 loader.go:359] Config loaded from file /root/.kube/config
I0301 10:32:00.957514   15895 loader.go:359] Config loaded from file /root/.kube/config
I0301 10:32:00.963325   15895 loader.go:359] Config loaded from file /root/.kube/config
I0301 10:32:01.979722   15895 round_trippers.go:405] GET https://api.qe-yinzhou.qe.devcluster.openshift.com:6443/apis/user.openshift.io/v1/users?limit=500 403 Forbidden in 1016 milliseconds
I0301 10:32:01.980232   15895 helpers.go:201] server response object: [{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "users.user.openshift.io is forbidden: User \"pm1\" cannot list resource \"users\" in API group \"user.openshift.io\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "group": "user.openshift.io",
    "kind": "users"
  },
  "code": 403
}]
F0301 10:32:01.980275   15895 helpers.go:119] Error from server (Forbidden): users.user.openshift.io is forbidden: User "pm1" cannot list resource "users" in API group "user.openshift.io" at the cluster scope

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0758