I'm writing to you with report about CWE-359: Exposure of Private Personal Information to an Unauthorized Actor / CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

It is connected with my previous report named "Account takeover - Account protection" (common parts).

At this moment there is very simple way to Account takeover (here as an example MediaWiki account).

The current proccess / approach is invalid, dangerous.

Repro steps (PoC):
(victim side)

1. User (as logged in) wants to change an email, so go to: https://www.mediawiki.org/wiki/Special:ChangeEmail

2. Type/change email to invalid (for testing purposes you can use your_email and your_email+alias - as another one), which user not own (misspell / mistake)

3. See message - changed sucessfully:

Change or remove email address
A confirmation email has been sent to the specified email address. Before any other email is sent to the account, you will >have to follow the instructions in the email, to confirm that the account is actually yours.

(bad actor side)

4. Open email sent to "wrong address" (ie.: with other browser type and with incognito/private mode ; victim made a mistake with email address), see message:

To confirm that this account really does belong to you and reactivate
email features on MediaWiki, open this link in your browser:
https://www.mediawiki.org/wiki/Special:ConfirmEmail/[chars]

5. Click that link to Confirm (as a Bad Actor)

6. See info:

Confirm email address
Your email address has been confirmed. You may now log in and enjoy the wiki.

7. Return to Special:UserLogin. So click Log in https://www.mediawiki.org/wiki/Special:UserLogin - BUT bad actor don't know the password or login, YET.

8. So click https://www.mediawiki.org/wiki/Special:PasswordReset

Reset password
Fill in one of the fields to receive a temporary password via email.

Add your mail (bad actor's email, from step nr 4; ie.: your_email_example+alias1@gmail.com )

9. Click Reset password, see message:

You have requested a password reset.
If the information submitted is valid, a password reset email will be sent. If you haven't received an email, we recommend that you visit the reset password help page or try again later. You can only request a limited number of password resets within a short period of time. Only one password reset email will be sent per valid account every 24 hours in order to prevent abuse.
The details you submitted are:
Email address: your_email_example+alias1@gmail.com
Return to MediaWiki."

10. Log in again to that "wrong / bad actor's email"

11. See message - with "Username: [real_victim_username] and Temporary password: [temp_pw]"

Additional information:
That informations were used to PoC of my previous report about "Account takeover - Account protection" - the key thing is real_victim_username.

Link - https://phabricator.wikimedia.org/T324322

Sources:
https://cwe.mitre.org/data/definitions/359.html
https://cwe.mitre.org/data/definitions/200.html