The vulnerability stems from missing access control in the distRepoMove handler. The patch adds an assertPolicy check to this method, proving it previously operated without proper authorization. The auth.py changes modify policy enforcement details but don't directly indicate vulnerable functions - the root issue was the complete absence of the check in distRepoMove prior to the fix.