The issue allows attackers to set an admin password under certain conditions. Specifically, it involves the API endpoint "/api/users/admin/check" which checks if the admin user is already created. If the admin user was not created, this endpoint returns a 404 status code, and if the admin user was already created, it returns a 204 status code. Attackers can exploit the 404 case to set an admin password.