The vulnerability stems from improper authorization in Inventory component API endpoints. Magento's REST API authorization typically uses ACL resources defined in webapi.xml. The described vulnerability suggests either: 1) Inventory source modification endpoints used overly broad ACL resources, or 2) Controller methods failed to implement proper authorization checks. The SourceRepositoryInterface::save method is central to inventory source persistence, and the Save controller handles modification requests. Both would require strict authorization checks that were likely missing or misconfigured, allowing users with basic Inventory permissions to perform unauthorized modifications.