The commit diff shows these functions were modified to add checkEventAccess() calls in the patched versions. The vulnerability reports explicitly mention missing access checks in backend module functions for data export and email notifications. The pre-patch versions of exportAction and notifyAction lacked the critical permission verification implemented through checkEventAccess(), which validates if the user has webmount access to the event's storage page.