The core vulnerability stemmed from improper access control lists in resource.php where 'editor' was included in allowed groups for service operations. The patch (a839a5a) explicitly removes 'editor' from these entries. The Base.php methods like saveItem become vulnerable vectors when combined with these flawed configurations, though the root cause is the configuration itself. High confidence in resource.php entries as they directly map to the described vulnerability, medium confidence in Base.php methods as they're execution points dependent on configuration.