The vulnerability stemmed from Publify's failure to implement backend authorization checks for user registration. The patch introduced a custom RegistrationsController (users/registrations_controller.rb) with a require_signup_allowed before_action to validate this_blog.allow_signup?. Prior to this fix, Publify used Devise's default controller, which lacked this check. The routes.rb configuration (using devise_for :users without overriding the controller) exposed the unprotected registration endpoint, making Devise::RegistrationsController#create the entry point for unauthorized registrations.