The vulnerability stems from missing authorization checks in promotion approval/execution flows. Status.java handles promotion actions via doApprove()/doRestart() endpoints, while ManualCondition.java governs approval logic. The advisory specifically calls out these files and describes missing permission checks for users with only Job.Read access. The functions identified are the entry points for promotion operations that lacked proper security controls in vulnerable versions.