# Account Takeover on unverified emails in File Sync & Share

Acronis File Sync & Share PUT /fc/api/v1/account accepted arbitrary email changes without verification, letting attackers take over unverified accounts and impersonate users.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: 0xcrypto
- Disclosed: 2021-06-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/906790
- Library page: https://bugbountylibrary.com/r/h1%3A906790
- Tags: area:web3 domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:account-takeover vuln:business-logic

**Target:** REST API endpoint PUT /fc/api/v1/account (profile update)
**Root cause:** The profile update endpoint trusted a client-supplied email field that the UI disabled, and applied it without any verification step, so an attacker could set any unverified email as the account's identity.
**Steps:**
1. Log in to https://mc-beta-cloud.acronis.com/fc/access as attacker.
2. Open Profile modal, click Save while intercepting in Burp.
3. Capture `PUT /fc/api/v1/account` with JSON body `{"name":"...","email":"..."}`.
4. Change `email` to a victim's unverified email (e.g. `hr@acronis.com`); if 'email already taken' the victim is verified, try another.
5. `204 No Content` confirms the email was changed; verify via `#/log`.
6. Invite the new email to a shared folder to confirm control.
**How found:** Researcher noticed the email field was disabled in the UI profile modal, suspected the backend still honored it, and intercepted the save request to inject an arbitrary email.
**Exploitation:** Attacker sets the victim's unverified email on their own account, then receives invites sent to that email while retaining login via their original credentials, impersonating the victim and accessing shared files.
**Escalation:** Attacker can impersonate arbitrary users and steal files via folder sharing; takeover is stealthy since the changed email is not reflected in the Management Control Dashboard.
**Insight:** When a UI field is disabled/read-only, always replay the underlying request with that field populated — server-side handlers often still bind it, especially on profile/account update endpoints where identity fields are trusted.