I am working in QA field and we have a project about a famous booking website.
I have discovered that if I create an account with the same name, surname and date of birth of an already registered account, I am able to see the personal page of the latter. This means that I can see his phone number, address and bookings.
Moreover, if I modify these fields also the settings of the original account will be modified. This means that I can also block another account by registering mine on a different market, because this will change its Country field and prevents him from logging from its market.
I have pointed out this behavior but I only got a "works as intended" answer.
Is this a severe security issue or it is just me? Thank you.