Update user email in custom module : validation API returns "Your current password is missing or incorrect"
The violations you're seeing come from core's ProtectedUserFieldConstraint. The constraint is applied when the current user tries to update their account fields without supplying a password. The validator method has a built-in flag to disable this check when needed (e.g. when a user resets their password).
To set the flag, set the _skipProtectedUserFieldConstraint to TRUE (e.g. $user-&gt;_skipProtectedUserFieldConstraint = TRUE;) and the validator won't enforce supplying a password when changing the current user fields.