We think zoom with a security issue: user can request account ownership without approve

[redious]

number user can request account ownership , and he will get the owner role in 72 hours  by default,

we think it was very dangerous, it was ZOOM SECURITY BUG!!! 

[Bort]

Hi @redious 

This is expected behavior for Pro accounts: https://support.zoom.us/hc/en-us/articles/115005686983-Changing-the-account-owner

This is designed to ensure that the loss of the account owner does not permanently disable an account. By default, only admins on a Pro account can request ownership, but if there are no admins, then normal members will have the ability to request it as well. 

As you stated, the owner receives an email about the request and has up to 72 hours to respond before the request is automatically fulfilled.

If you need ownership returned to the original host, you can contact Zoom Support to assist. 

[Bort]

The good news is that this weekend we are changing the time frame in which the owner must respond to that email. The owner will have 7 days, instead of 3 days. Check out the web releases notes for more info about this update: https://support.zoom.us/hc/en-us/articles/204758419

[aflo]

I received this email "Re: Anna MTL(***********) has requested to be the owner of your Zoom account" - the email had NO WAY of contacting zoom, refusing this transfer of ownership, nor any link to instructions.  When I contacted zoom they said it was fortunate that the person canceled the request.    Where do we report that a change must be made that I never have to question my ownership.  The process should be that after verification that it is the owner, he/she/etc. may transfer the account to a new owner.  I'm shocked at this.  3 or 7 days PROCESS is incorrect.  completely.  What if I'm on vacation?  I vacation longer than 7 days - whoops, your account was transferred.  Really?