EssentialsX dev 434
PaperSpigot dev 885

Players that are hidden via VanishNoPacket or Essential's vanish are displayed to everyone in /list | /who regardless if they have the permission to see hidden players or not (essentials.list.hidden). It shows the [HIDDEN] tag on the vanished staff member as a Member who only has the permission essentials.list.

Shouldn't hidden players not be listed in /list unless you have permission to see them via essentials.list.hidden? Or is that permission only for groups that are forced hidden in the display formatting?

# Sort output of /list command by groups.
# You can hide and merge the groups displayed in /list by defining the desired behaviour here.
# Detailed instructions and examples can be found on the wiki: http://wiki.ess3.net/wiki/List
list:
    # To merge groups, list the groups you wish to merge
    #Staff: owner admin moderator
    #Admins: owner admin
    # To limit groups, set a max user limit
    #builder: 20
    # To hide groups, set the group as hidden
    #default: hidden
    # Uncomment the line below to simply list all players with no grouping
    #Players: '*'
    default: 100

Not able to replicate this using Essentials Vanish. If you're using another Vanish plugin and having this issue, it is likely because they are not using the Bukkit API for marking players as vanished.