The vulnerability stems from API endpoints returning full process group details including unauthorized child components. The primary entry point would be the ProcessGroupResource.updateProcessGroup controller method that handles PUT requests. This method likely called service layer methods like ProcessGroupService.getProcessGroup that retrieved complete entity data. The pre-patch implementation didn't perform sufficient authorization checks on contained components when serializing the response. Runtime detection would observe these functions in call stacks when processing process group update requests that expose sensitive components.