If the users were not in the config before the upgrade, nothing in the upgrade could have done that.
I don't see any sign of local users other than admin, or signs of RADIUS or LDAP being used. Something or someone else must have removed the users from that configuration before.
There haven't ever been any bugs that I can recall that would remove all users except admin.
I'd look for an older backup, see if they are in there.