The vulnerability stems from CobblerXMLRPCInterface exposing all class methods over XMLRPC without proper authentication. The GitHub commit explicitly adds access checks to 'modify_setting', confirming it was previously unprotected. This function's ability to alter system settings (like security flags) made it a critical attack vector. While other methods in the class were likely also exposed, 'modify_setting' is specifically documented in the patch and vulnerability reports as a key entry point for privilege escalation.