The vulnerability stems from improper handling of ip_allow.config updates in ORT. The commit diff shows critical changes to the process_cfg_file subroutine where a new guard clause was added to prevent ip_allow.config updates unless in 'badass' mode or with explicit syncds_updates_ipallow flag. Before this patch, the function lacked these safeguards, allowing unauthorized updates that could propagate insecure permissions. The direct modification of this function in the patch to add security checks indicates it was the source of the vulnerability.