The vulnerability stems from missing access control checks during permalink preview generation. The primary suspect is the permalink preview handler (app.GetPermalinkPreview) which would be responsible for channel visibility checks. The medium-confidence entry (app.GetChannel) reflects the possibility that the channel retrieval function might not properly enforce archived channel visibility rules in all contexts. The confidence stems from the vulnerability's description specifically mentioning the missing check during permalink previews, which would typically involve these core channel interaction functions.