The CVSS 5.3 score on this CVE is misleading, but not for the reason you might expect. This isn't a minor authorization bypass—it is a symptom of architectural decay in access control enforcement that has likely allowed unauthorized data to accumulate in your system for years.
The critical distinction is mechanistic rather than numerical. A typical authorization bypass means security controls exist but fail under specific conditions. This vulnerability is different: the undocumented POST method on these deprecated endpoints was apparently never hooked into the capability framework at all. It predates the security model, meaning it operated outside the threat model from the start. The "undocumented" label is the signal—developers documented PUT (which has capability checks) but not POST, suggesting this code path simply never entered the audit scope when the capability system was introduced.
This has two implications that the CVSS score cannot capture. First, the config and blob repositories are potentially polluted with objects added by users who should never have had write access. Those objects may now be consumed by downstream systems, parsing logic, or automated workflows that trust the repository as a source of truth—a malicious config object doesn't need to be exploited, it just needs to exist and be processed. Second, this is likely not an isolated case. If deprecated endpoints have undocumented methods that escaped the original capability framework audit, other forgotten paths probably exist in the codebase.
Your immediate actions: verify what the 2.19.0 patch actually changed—did it disable POST entirely, add capability checks, or both? The distinction matters for long-term security posture. If it's only disabled without capability enforcement, future undocumented methods could bypass controls again. Audit other deprecated endpoints for similar undocumented code paths. Most critically, assess what unauthorized objects already exist in your config and blob repositories and whether downstream systems have already processed them—this contamination window may be years deep and unrecoverable.