Battle.net (WoW) - Recruit a friend logic / security bug

Dear Devs!

I’ve found a bug in the Battle.net WoW RAF.

Summary:
The backend logic isn’t validate the eligibility for RAF.

Steps to reproduce:
Open a WoW RAF invitation where you can see all of your accounts in a list.
(The system marks the account as eigible or ineligible.)
The accounts those are ineligible are disabled, but if you overwrite this state to enabled, you can submit the form.

Expected results:
Kind of an error message, your account is ineligible for this action.

Actual results:
As the backend logic isn’t validate the eligibility for RAF you can attach ineligible accounts to your friend.

Best regards,
Adam