CVE-2022-36073

RubyGems.org (the RubyGems host) is affected by CVE-2022-36073 due to a bug in the password and email change confirmation flow that lets an attacker change an account’s email to an unowned address. This could enable the attacker to access saved API keys and, after an authenticated user resets the...