Missing session cleaning in the customer module during change e-mail request operation can lead to unwanted privilege escalation.
This vulnerability affects the following application versions:
- Magento 2.3.3
- Magento 2.3.3-p1
- Magento 2.3.4
- Magento 2.3.4-p2
- Magento 2.3.5
- Magento 2.3.5-p1
- Magento 2.3.5-p2
- Magento 2.3.6
- Magento 2.4.0
- Magento 2.4.0-p1
- Magento 2.4.1