The vulnerability stems from the lack of CSRF protection in the Rails application. The commit diff explicitly adds protect_from_forgery to the ApplicationController, which is a Rails security mechanism to validate requests with authenticity tokens. Without this line, all controller actions inheriting from ApplicationController (the base controller) are exposed to CSRF attacks. The advisory and CVE description directly attribute the vulnerability to this missing protection, making this the definitive root cause.