Remote password change in trac.torproject account

I was trying to recover my password and I tried to register my user again so a noticed there is a vulnerability, any user can actually change any users password.

Go to:

https://trac.torproject.org/projects/tor/register

Just put any username with the password you want and then that is going to automatically change it.

Trac:
Username: Dedalo