CVE-2023-6152

What it actually does

The flaw permits an authenticated user to update their registered email address via profile settings without triggering any verification step when verify_email_enabled is active, because the option only enforces verification during initial signup.

Why it matters to the business

Attackers who obtain initial account access can silently redirect account recovery and notifications to addresses they control, enabling persistent unauthorized access and potential data or account takeover.

How an attack unfolds

An attacker creates an account using a verifiable email, completes signup verification, then immediately modifies the email field in profile settings to an attacker-controlled address; no further confirmation is required, allowing the attacker to receive password resets and other account communications.

How to fix it

Modify the email-update workflow to require verification for every change regardless of the verify_email_enabled setting; enforce the same validation logic used at signup on all profile email modifications.

How to confirm the fix worked

Create a test account, verify the initial email, attempt an email change through profile settings, and confirm that a verification token or confirmation step is now required before the change is accepted.

Typical attack path

1. Obtain or create a verified account
2. Authenticate to the application
3. Access profile or account settings
4. Submit a new email address without verification challenge
5. Receive account recovery tokens at the new address

How to detect it

Search authentication and audit logs for email address update events that are not followed by verification email sends or token issuance within a short time window.

What your security team should do

• Review all authentication and profile-update code paths for missing verification steps
• Add automated tests that assert verification is enforced on email changes
• Monitor authentication logs for email address modifications that lack corresponding verification events