The vulnerability stems from an endpoint accepting non-POST requests for a sensitive action (database reindexing). The fix in commit 828f79f adds @RequirePOST annotation to this handler, confirming it was previously vulnerable. The function's purpose (rebuildDatabase) and the CVE description about missing POST validation directly correlate.