We have a Trac with dozens of instances. We needed to find all the users because there is some big username convention change going on. Trac doesn't have a 'user' database, and the 'auth_cookie' table only shows the current sessions; but it does have a 'permissions' table, and that's just the ticket (sorry).
So we go to the directory above all our Trac instances and loop over them, running a DB query to find the usernames, then piping them to sort and uniq commands because we don't care which instance the users came from:
for t in *; do sqlite3 $t/db/trac.db "select distinct username from permission"; done | sort | uniq > /tmp/tracusers.txt