Email Verification Bypass / Email Squatting via Client-Side accounts.setAccountInfo

Summary

A major organization's identity platform (built on a managed Customer Data Cloud / Gigya stack) let any authenticated user change their account email to an arbitrary unregistered address through the client-side accounts.setAccountInfo() API call — with no verification email, no CAPTCHA, and no re-authentication with the current password.

The registration flow enforces both email verification and CAPTCHA, but this client-side call bypasses both. Root cause: the profile.email field is configured with writeAccess: clientModify in the identity schema (confirmed via a publicly accessible accounts.getSchema endpoint), so the client is allowed to write it directly.

• Class: Business Logic Error (CWE-840) + Improper Access Control (CWE-284)