Adobe Experience Manager Incorrect Authorization Vulnerability Allowing Security Feature Bypass

An incorrect authorization vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23.0 and earlier. This vulnerability allows a low-privileged attacker to bypass security measures and gain unauthorized write access. The issue arises from improper validation of user permissions, enabling attackers to exploit this flaw and manipulate content or settings without proper authorization.

Impact

Exploitation of this vulnerability could lead to unauthorized write access, allowing attackers to modify content or settings within the application.

Remediation

Users are advised to update to Adobe Experience Manager 6.5.23 (GRANITE-61551 Hotfix) or to AEM Cloud Service Release 2025.9. For assistance with AEM versions 6.4, 6.3, and 6.2, please contact Adobe customer care.