This form has no CSRF token and no re-authentication. Because the session cookie is not SameSite=Strict, a cross-site auto-submitting form can point email at an attacker address — changing the email with no token is the takeover primitive (password-reset links then flow to the attacker). Minimal PoC:
<form action="/m05/account/email" method="POST"> <input name="email" value="attacker@evil.example"> </form><script>document.forms[0].submit()</script>
The API endpoint /m05/account/email-json parses the body as JSON regardless of Content-Type. Send a "simple request" (text/plain) so the browser skips the CORS preflight, and a cross-site JSON CSRF lands. The PoC Tester fires this shape.