Information disclosure on password cancel endpoint

few month ago I found #2106662 and team resolved so I was testing then I got same vulnerability in https://bugzilla.mozilla.org/. when someone try to get password reset token so then if they will cancel password reset to they will get email notification and email contain victim IP address. so …

It's low hanging security risk but it's significant for users. where attacker able to get victim IP, Address.
This is disclosing users information. one click information disclosed. 

Suppose attacker create account on https://bugzilla.mozilla.org/ Now attacker knows the victim created also account …