The vulnerability stems from missing access checks in Extbase's request handling pipeline. The Dispatcher class is central to routing requests to controller actions. The security bulletin explicitly states the lack of access checks for controller/action combinations, which aligns with the responsibility of the Dispatcher::dispatch method. The medium confidence for ActionController::processRequest reflects its role in action execution, though the primary flaw resides in the dispatcher's access control gap. The patches in versions 6.2.24/7.6.8 likely added access checks in these critical paths.