Update user email in custom module : validation API returns "Your current password is missing or incorrect" Users can update their email and user name in a form (Form API) in a custom module. The reason is it also updates an external service.
It works well but I’ve noticed an error during our test if a user enter an existing email (which is forbidden).
So I’ve added a validation $user-&gt;validate()
Now, I have this error message :

Your current password is missing or incorrect; it's required to change
the email/.

I don’t know how to proceed. Should I retrieve the user password  and send it again $user-&gt;setPassword($password); ? I've search on SO, Drupal Doc, etc. but I didn't find the correct way to do this.
Here is my code :
$uid = \Drupal::currentUser()-&gt;id();

// Get user storage object.
$user_storage = \Drupal::entityManager()-&gt;getStorage('user');

// Load user by their user ID
$user = $user_storage-&gt;load($uid);


 /**
 * Validation API
 * https://www.drupal.org/docs/8/api/entity-validation-api/entity-validation-api-overview
 */
 
  // Update email
  $user-&gt;setEmail($new_email);

  // Update username
  $user-&gt;setUsername($new_email);

  $violations_user = $user-&gt;validate();
  if ($violations_user-&gt;count() &gt; 0) {
       $violation = $violations_user[0];
       drupal_set_message($violation-&gt;getMessage(), 'warning');
       // Here is the message &quot;Your current password is missing or incorrect&quot;
  } else {

      $user-&gt;save();
  }
The violations you're seeing come from core's ProtectedUserFieldConstraint. The constraint is applied when the current user tries to update their account fields without supplying a password. The validator method has a built-in flag to disable this check when needed (e.g. when a user resets their password).
To set the flag, set the _skipProtectedUserFieldConstraint to TRUE (e.g. $user-&gt;_skipProtectedUserFieldConstraint = TRUE;) and the validator won't enforce supplying a password when changing the current user fields.