The vulnerability stems from insufficient access control in the check_capability method. The patch adds critical checks for session_is_loggedinas() and repository context privacy (via contains_private_data()). In vulnerable versions, this function only checked basic capability permissions without considering impersonation scenarios or repository privacy context, enabling unauthorized access to external repositories when using the 'login_as' feature. The addition of these checks in the commit confirms this was the vulnerable entry point.