The vulnerability stems from missing authorization checks in REST API endpoints handling server management operations. Based on the advisory's explicit list of affected operations (server stop, cluster stop, server report, cache ignore list), we identify the corresponding handler methods in Infinispan's REST API implementation. These functions would appear in runtime profiles when unprivileged users execute privileged operations, as they process requests before the (missing) authorization check would normally occur. The high confidence comes from the exact match between documented vulnerable operations and standard Infinispan REST API implementation patterns.