Cloudron Forum

@nebulon I mean the place where all users are listed.

There is a risk that the password change may become missused to gain unauthorized access to someone else account. All because the fact that the password change form doesn't ask for neither old password, or 2FA key (if it's enabled for the user).

The best example of that is visible in the online demo

I want to report a serious security bug that allow unauthorized access to someones else account.

Description:

The password change option generates a password change link, with doesn't verify neither the old password, nor the 2FA(if enabled) and allow to change the other user's password and then access that profile.