The vulnerability stems from missing cache invalidation after configuration changes. The primary vulnerable function is 'configure' (or equivalent config persistence method), which failed to clear the permission cache when settings were updated. Secondary is 'getGrantedPermissions' (or similar) which served stale data from the cache. These functions are central to the permission lifecycle - configuration updates and permission checks - making them key runtime indicators when profiling exploitation attempts.