    public InternetAddress requestResetPassword(UserReference user) throws ResetPasswordException
    {
        if (this.authorizationManager.hasAccess(Right.PROGRAM)) {
            ResetPasswordRequestResponse resetPasswordRequestResponse =
                this.resetPasswordManager.requestResetPassword(user);
            this.resetPasswordManager.sendResetPasswordEmailRequest(resetPasswordRequestResponse);
            return resetPasswordRequestResponse.getUserEmail();
        } else {
            return null;
        }
    }
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.