Grafana -- Email verification is not required after email change

Grafana Labs reports:

The vulnerability impacts instances where

  Grafana basic authentication is enabled.

Grafana has a

  verify_email_enabled configuration option. When this option is enabled,
  users are required to confirm their email addresses before the sign-up process
  is complete. However, the email is only checked at the time of the sign-up.
  No further verification is carried out if a user’s email address is updated
  after the initial sign-up. Moreover, Grafana allows using an email address
  as the user’s login name, and no verification is ever carried out for this email
  address.

This means that even if the

  verify_email_enabled configuration option is enabled, users can use
  unverified email addresses to log into Grafana if the email address
  has been changed after the sign up, or if an email address is set as the login
  name.

The CVSS score for this vulnerability is [5.4 Medium] (CVSS).