Email not verified when changing afterwards on apps.nextcloud.com

How it was found

Summary:

Email Verification Bypass is a dangerous vulnerability, which is found in Web-Applications. An Attackers can bypass the control mechanisms which are used by the underlying web application like Email verification, OTP, Captcha, 2FA, etc. An Attacker can perform a complete Account takeover of Victim.

Attacker Can use any Victim mail without verification.

Steps To Reproduce:

1. Go apps.nextcloud.com
2. Create a fake Account with attacker mail
3. Than Attacker mail do Change to Victim mail without verification.

Supporting Material/References:

(Video poc Attached)

Impact

This issue can be used to bypass email verification on signup. Attackers can create account on behalf on any person without having access to the email account. This issue is affecting integrity of the apps.nextcloud.com.