The vulnerability stemmed from improper authorization in ownership transfer functions. The core issue was in setSubnodeOwner() which allowed parent node owners to retain control over subnodes after transferring them, as they could call this function again to reset ownership. The setOwner() function similarly lacked mechanisms to prevent previous owners from reclaiming control. The commit diff shows these functions were modified in the patched version (adding return values and authorization checks), and the CWE-285 classification confirms improper authorization was the root cause.