ELOG contains a vulnerability that allows an authenticated user to modify another user's profile, including changing the email address. This can enable an attacker to request a password reset and gain control of the target account. By default, ELOG does not allow self-registration, which may limit exposure.