Pentester here. Absolutely something I would look at and abuse. You're disclosing information, allowing the harvesting of valid email addresses, and allowing ac

Pentester here. Absolutely something I would look at and abuse. You're disclosing information, allowing the harvesting of valid email addresses, and allowing access to an account. even if only in a limited capacity for email management, based on only the email. There's no reason to do it this way. See here: https://portswigger.net/web-security/access-control/idor https://portswigger.net/web-security/access-control/idor