Physical Access to Mobile App Allows Local Attribute Updates without Authentication

Summary

Physical access to mobile device allows attacker to replace boolean flag to update firstname,lastname, email and mobile number in app only - not changed on backend.

If we want to update or changed the profile information in mobile application then It will asks for the password. Using this vulnerability I can able to bypass that password.