The vulnerability stems from improper authorization checks in the forum portfolio export functionality. The portfolio_caller class handles file references when exporting forum posts but didn't properly validate if the user had permission to access each referenced file. The get_sha1 function's hash generation and prepare_package's file bundling process would be natural points where file references are processed without adequate permission checks, allowing URL parameter manipulation to access arbitrary files. These functions are core to the portfolio export mechanism and align with the described attack vector of modifying download URLs after post export.