Security Issue at Mango3D / Lychee Slicer

A month ago, I found a way to take over any Mango3D customer account, provided you know their name and account email address, maybe also their country.

I realised this when I asked support to change the email associated with my account: This is done via a web form that apparently sends an email to the Mango3D support team, without the support team being able to verify whether that issue was raised by the correct person. The way support verifies whether the request to change the account email comes from the correct person is to ask for a screenshot from the account dashboard. 

Such screenshots can, of course, be trivially faked, see this one here:

 This means that as long as I know some basic information and the email address of any Mango3D customer, I can take over their account. This information can be easily retrieved through data leaks from other companies, social media, etc. 

On July 28th this year, I raised this matter via multiple channels to Mango3D and strongly suggested that they change this to a flow that requires people to receive and send emails from both the old and new email account. Ideally to automate it so that people also need to log in with their whole credentials during that flow. 

As I haven't heard anything from Mango3D that indicates that this issue is actively being fixed, I now disclose the problem publicly. If you have a Mango3D account, I strongly suggest to change the account email to something other than your standard email address as a security measure.