Boozt Fashion AB: No Confirmation During Email Change

ID H1:280304
Type hackerone
Reporter craxermgr
Modified 2017-10-23T13:52:29


Hello Team, Your system is letting to change email address without confirmation. User can change the password without any confirmation. Anyone can access or make change to any account if that account is logged in public computer. So, it is better to send email to user email and confirm the changes.