The vulnerability stems from API endpoints requiring security tokens that are never validated. The GitHub issue #1916 explicitly demonstrates modify_setting() and get_systems() as examples of this pattern, where token parameters are declared but unused for authentication. The upload_log_data() function becomes exploitable due to the ability to manipulate its guardrails via modify_setting(). These functions are part of the CobblerXMLRPCInterface class exposed via /cobbler_api, and the blog post/issue demonstrate concrete exploit scenarios for these endpoints.