Mass assignment led to ATO

There were two forms:

• One to change the email address, which required verification.
• Another one to update the user's profile information.

The email field wasn't available in the second form.

So I intercepted the request.

And there it was.

An email parameter was being sent in the request body, even though there was no email field in the UI.

That immediately caught my attention.

I had two test accounts:

• Attacker account
• Victim account

I took the request from the attacker account and modified the email parameter to the victim's email.

I sent the request.

It worked.

No email verification. No confirmation. Nothing.

At this point, only the attacker email changed to the victim email and I wasn't sure how the application would handle the situation.

So I logged out.

Then I tried:

Victim's email + Victim's password

❌ Invalid credentials.

Okay… interesting.

Then I tried:

Victim's email + Attacker's password

And it worked.

I was now logged in and could see the victim's data in the account settings.

So a parameter that wasn't even exposed in the UI allowed me to modify the email address without going through the application's intended email-verification flow.