The vulnerability stems from two form validation methods handling Azure configuration verification. Both methods were vulnerable because:

1. They lacked @RequirePOST annotations, making them susceptible to CSRF attacks
2. They didn't perform Jenkins.ADMINISTER permission checks, allowing users with only Overall/Read access to execute them
3. The commit patching the vulnerability specifically adds these security measures to both methods
4. The advisory explicitly mentions these methods as the attack vector for information disclosure
5. The CWE-862 (Missing Authorization) directly maps to the missing permission checks in these functions