The issue is related to an Incorrect Access Control vulnerability in the `send recovery email` function. This vulnerability can lead to Administrator Password Reset Poisoning, where an attacker can create a reset URL pointing to an attacker-controlled server by using a host header attack.