The vulnerability stems from a missing 'XSS risk' flag in the capability definition for 'moodle/course:managegroups' in lib/db/access.php, not from specific functions. The patch adds the RISK_XSS flag to this capability's metadata, indicating the vulnerability was caused by improper security labeling rather than flawed function implementations. While the capability is used in XSS-prone contexts, the advisory and commit diff don't identify specific functions that handle unsanitized input. The root issue is a missing risk declaration in the access control configuration, not vulnerable code in particular functions.