Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries

Summary

We discovered an authorization issue in app.lemlist.com where a tenant admin could change the password of another user within the same tenant, including invited agency accounts. The victim must first accept the invitation before the attacker can proceed. The issue could allow unintended account access within a shared tenant environment, but MFA successfully prevented logins when enabled. The Lemlist team was notified and addressed the problem to ensure stricter access controls for user credential changes.