Attacker, who is an authorized system user, simply changes the URL to a privileged unprotected page and gets the access of it. This happened due to :
Failure to Restrict URL Access
Cross Site Scripting
Broken Authentication and Session Management
Insufficient Transport Layer Protection