This CVE exposes a structural weakness that emerges when static file serving and REST API routing are maintained as separate security domains, creating access control drift that quietly erodes intended protections. The core issue isn't a single missing check — it's an architectural inconsistency baked into how the application handles two different delivery mechanisms for the same underlying resource.
Static file routes in web servers often receive less rigorous security treatment than API endpoints because developers mentally categorize static content as infrastructure rather than application logic. This cognitive separation means the publish-access model gets carefully implemented in the REST handler layer but simply doesn't exist in the static path. The gap persists because there's no automated mechanism forcing these two code paths to inherit the same access constraints. The CVSS of 5.8 partly reflects that exploitation requires either a limited-privilege token or a specific deployment configuration, but it doesn't capture how thoroughly this undermines the trust boundary for any organization using publish tokens as a meaningful control.
The v3.7.4 patch likely adds the missing access check to the specific static routes identified in the CVE. That's necessary, but if the fix is localized rather than structural, new static routes will inherit the same permissive default. The more durable approach would require static route registration to explicitly declare what access controls it claims to enforce — or doesn't — rather than defaulting to permissive behavior. Without that explicit declaration in the route registration, there's nothing preventing the next performance-minded commit from recreating the same gap.
The real question is whether the static route layer should inherit API-level access controls outright, or whether the access model needs formalization across both code paths so they can't drift apart again. The former is simpler; the latter is more robust. Organizations using publish tokens as the gating mechanism for sensitive templates should treat this as an architectural-level concern, not just a check-level one.