The vulnerability stems from insufficient authorization checks when retrieving course participants. Moodle's user management system relies on course context validation and capability checks ('moodle/course:viewparticipants'). The primary function for participant retrieval (core_user::get_participants) would be the logical location for missing context validation, while enrollment functions like enrol_get_my_courses might contribute to improper course ID selection. The high confidence in core_user::get_participants aligns with the vulnerability's core mechanism described in advisories.