The issue allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions. This is achieved by uploading an avatar file with an accepted Content-Type, such as `image/jpeg`, and then accessing it via a direct request to the file in `files/standard/avatar`. This enables the upload and execution of arbitrary files.