Broken authorization on password reset — full account takeover

Summary

The password reset endpoint trusted a client-supplied user_id parameter instead of deriving identity from the active session. As a result, any authenticated user could reset the password of any other account simply by changing that parameter.

Steps to reproduce

• Trigger a password reset on your own account and intercept the confirmation request.
• Change the user_id field to a victim's numeric ID.
• Submit the request — the server accepts the new password without validating ownership.

Impact

Full account takeover for any user, including admin accounts, with no interaction required from the victim.