The vulnerability stemmed from improper cleanup of legacy ClusterRoleBindings (CRBs) that granted excessive privileges. The key issues were:

1. The original reconcileProjectAccessToGlobalResourcesForDelete function in prtb_handler.go only checked for active ProjectRoleTemplateBindings (PRTBs) before deleting CRBs, but didn't properly validate ownership labels across all possible binding types.
2. The system allowed CRBs with patterns like 'create-ns', 'namespaces-*', and 'promoted' roles to persist after user removal, which were later exploited for privilege escalation.
3. The patch introduced new cleanup logic (noRemainingOwnerLabels, legacy CRB cleaner) and removed flawed checks, confirming the original functions' inadequacy in permission revocation. While the exact vulnerable function names aren't explicitly called out in descriptions, the code changes in prtb_handler.go and the CWE mapping to improper access control strongly indicate these functions as the root cause.