The vulnerability stems from missing CSRF token validation in JSON endpoints. The patch adds 'before_filter :check_json_authenticity' to these controllers, confirming they previously lacked this protection. The commit diff shows these endpoints were vulnerable because they returned sensitive data without validating the authenticity token in GET requests, a classic JSON hijacking vector. The admin_token_passed_in_headers method in api/base_controller.rb was also vulnerable but primarily impacts API access rather than the admin UI endpoints explicitly mentioned in the CVE description.