Complete or Edit Another User's Profile

How it was found

Hi, I've found an issue where verified users can complete and submit a profile on behalf of another user. I've attached two video POCs (unlisted on YouTube).

Completion - https://www.youtube.com/watch?v=erH7ShUpqso Editing - https://youtu.be/IQboAIHNpq4

Steps to reproduce:

1. Register a new user account
2. Verify the account via the email from Veris
3. Do not complete the profile but note the url. Create a new account.
4. Complete the account creation for the second user.
5. Logged in as the second user, navigate to the profile creation url from the first user.
6. Submit the values.
7. User 1 receives an email that their profile has been created.

Additionally, even after a profile has been set up, you can still edit it as a second user, at least if the steps above are followed. Assuming you did the steps above:

8. Navigate back to the /portal/complete-profile/XXXXX/
9. Change the values and resubmit the form
10. User 1 receives an email that their profile has been updated

Please let me know if you need any additional information.