The vulnerability stems from missing access checks in wiki.php's project handling logic. The original code called project_ensure_exists() to verify project existence but did not call access_ensure_project_level() to validate user permissions. This allowed any authenticated user (even with minimal privileges) to brute-force project IDs and observe redirection URLs containing private project names. The patch added the missing access checks, confirming these were the critical missing security controls.