Boozt Fashion AB: No Confirmation During Email Change

2017-10-19T07:55:36
ID H1:280304
Type hackerone
Reporter craxermgr
Modified 2017-10-23T13:52:29

Description

Hello Team, Your system is letting to change email address without confirmation. User can change the password without any confirmation. Anyone can access or make change to any account if that account is logged in public computer. So, it is better to send email to user email and confirm the changes.