I think this is a bug as far as I can see while debugging.
-
It throws a ValidationError which extends the ApplicationError in plugin-user-permissions > server > controllers > auth.js
-
Then it is caught in the middleware strapi > lib > middlewares > body.js and re-thrown. Here the error is an instance of Error but I cannot see if it is an instance of ApplicationError or ValidationError as this is not available in body.js.
-
Then it is caught in the middleware strapi > lib > middlewares > errors.js but here the error is no longer an instance of ApplicationError and therefore the HTTP status is set to 500 in formatInternalError as a catch all status.
I am not sure why the error is not recognized as ApplicationError as I do not understand the code enough. I will raise an issue on GitHub.