The vulnerability stemmed from Stapler's view dispatching mechanism not performing authorization checks. The fix introduced DispatchValidator integration in Facet's dispatcher creation (via createValidatingDispatcher) and added validation in ScriptRequestDispatcher. The original vulnerable functions were the view dispatching entry points that lacked these checks, particularly in Jelly/Groovy view rendering paths. The commits show these components were modified to add security validation, confirming they were the missing authorization points.