Adobe Experience Manager version 6.5.9.0 (and earlier) are affected by an improper access control vulnerability that leads to a security feature bypass. By manipulating referer headers, an unauthenticated attacker could gain access to arbitrary pages that they are not authorized to access.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-42725
• https://helpx.adobe.com/security/products/bridge/apsb21-94.html
• https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html