HexBrain

Nextcloud · Report #308156

Email Notification should be get while changing password on apps.nextcloud.com

Informativestatus
7upvotes
28 Feb 2018disclosed

How it was found

Hi,

There is an issue with password reset functionality with Nextcloud: user is not receiving notification when he reset password.

Issue: user not always gets a notification about password change. When user change his password then a notification is not send to the user.

It is good to always send email notification for user when a password change.

Impact

It would be critical issue if user kept his/her account logged-in into PC or cyber cafe, then attacker can change his/her password without knowing to the user. Please letme know if you have further questions

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original