🔺Severity: Medium
👽 Reporter: 0xmanticore
⭐️ Reputation: 449
🛠 State: resolved
💼 Team: Yelp
💵 Bounty: null
🕐 Submitted: 2026-05-28
⏰ Disclosed: 2026-07-02 15:36:44
📝 Summary: The Yelp Biz Android app's Account Information screen was found to have a vulnerability where the email field was presented as read-only with a lock icon, but could be silently modified via the API endpoint
POST /account/info/bio/v1. The change was reflected immediately in the app's user interface as well as in the GraphQL API, without any current-password check or out-of-band email confirmation.📂 Report JSON File: 3766455
@hackeronereports