The vulnerability stems from the User model's unsafe mass assignment configuration. The GitHub patch shows :spree_role_ids was explicitly removed from attr_accessible in app/models/spree/user.rb. Before the fix, this attribute whitelisting allowed arbitrary role assignment via user input. The commit message 'Remove Mass Assignment of Role IDs' and added controller logic to handle role assignment separately confirm the root cause was mass assignment via this model's attr_accessible declaration.