0-click Account Takeover and Admin Operations via helper endpoint authorization bypass

The helper endpoint responsible for updating user email addresses performs a sensitive account mutation without performing any authentication or authorization beyond confirming that an Authorization header exists. Api::Internal::Helper::BaseController#verify_authorization_header! only checks for the header’s presence and does not enforce a signature, token, or identity check unless an action explicitly invokes authorize_hmac_signature! or authorize_helper_token!. The UsersController never calls either method, leaving POST /api/internal/helper/users/update_email callable by any unauthenticated client that supplies an arbitrary header (e.g., Authorization: foo).

An attacker can submit current_email and new_email parameters for any account, causing the controller to look up the target user via User.alive.by_email and set user.email = params[:new_email] with no ownership verification. Persisting the change allows the attacker to initiate password resets to the new email address, effectively taking over the victim’s account. This is a direct broken access control vulnerability with high impact on account integrity and confidentiality.