CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

Apache Sling Security Bundle before version 1.3.2 contains an origin validation error (CWE-346) in its ReferrerFilter, the component that guards against cross-site request forgery by checking the Referer/Origin header on state-changing requests. The filter accepts 'weaker-than-origin' evidence, meaning a request whose referrer does not strictly match the target origin can still pass the CSRF check. An attacker who lures an authenticated user of a Sling-based application (Sling underpins Adobe Experience Manager) to a malicious web page could silently submit forged POST requests that pass the filter and perform actions as the victim, such as modifying or publishing content, changing configurations, or creating users. Any deployment running the Sling Security Bundle older than 1.3.2 is affected; exploitation status is currently unknown, with no public proof of concept and no listing in the CISA Known Exploited Vulnerabilities catalog. The issue is fixed in version 1.3.2.