The vulnerability describes missing authorization checks in HTTP endpoints for consumer management. Based on Jenkins plugin patterns:

1. Webhook creation endpoints typically handle POST requests and would require admin privileges
2. Consumer deletion operations would map to doDelete* methods
3. List operations would correspond to GET handlers While exact method names aren't shown in advisories, the standard Jenkins controller naming conventions and endpoint security patterns strongly suggest these functions would be responsible for the vulnerable operations described.