The vulnerability stems from insufficient access checks in calendar/externallib.php's web-service handler. The key commit 76aea85 shows that the fix involved adding context validation (self::validate_context) to the get_calendar_events function. Prior to this patch, the code only checked course enrollment but didn't validate context permissions, enabling unauthorized data exposure. The vulnerability description explicitly mentions calendar/externallib.php as the source, and the CWE-200 classification aligns with missing authorization checks in this function.