The vulnerability stems from the unpatched doShowScript method which handled script content requests without verifying if the user had appropriate privileges. The commit diff shows the addition of permission checks (hasAnyPermission and checkPermission calls) to this method, confirming the original version was missing these controls. The CWE-862 classification and advisory description directly match this missing authorization pattern.