I was registering on an e-commerce website (no, I'm not gonna name it), when, due to my pentest nature, I captured the GET request for resending a confirmation email.
What I noticed was, when I entered a registered email (on the website, my friend's account) as the GET request, I saw a blank page. When I entered an unregistered but existent email (my alternate email), i got redirected to the homepage, i.e. ecommerce.com
Is this a serious vulnerability? All it can tell is if someone is registered or not, but then again, a python script and you could process it all quite fast.
Should I report this?