The removal of account is one of the sensitive part of a web application that needs to protect, therefore removing an account should validate the authenticity of the user, however i have found that when removing an account, the system did not require the user to input the account password.
Steps to reproduce:
goto https:
login to your account.
go to “Account Settings”.
you'll see the " Delete Account " button.
press that button and you just need to enter "Email Address” and submit .
you can see your account got deleted successfully.
Mitigation: Put reauthentication when anyone/user is deleting an account, ask the user to input password before the completion of the account deletion.
Let me know if you need more information.
Thanks,
Impact
Exploit Scenario:
The user logins to a shared computer (office, library, cafe)
Left the account open.
Intruder came and try to delete the users account
Intruder can easily delete the account because the system did not protect it by asking the password to validate that the person deleting the account is the real user.