The title makes it sound like the whole exploit chain is the headline, but the tl;dr is really just “XStream allowlist miss plus a few follow-ons,” and putting the actual result behind a CVE label is a bit much.

"allowlist that is additive rather than exclusive" That sentence is the whole bug, and it is not some subtle gotcha, it is a policy mistake. If your deserializer still happily wanders into a documented gadget chain after you thought you had an allowlist, the allowlist was theater. The rest of the chain is just embarrassment layered on top of that.