ColdFusion is affected by an incorrect authorization flaw that allows a low‑privileged attacker to bypass security controls and gain write access to protected resources. The vulnerability changes scope, enabling the attacker to alter data or files that would normally be protected from non‑privileged users.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are impacted. No specific release versions are listed in the advisory.

The CVSS score is 7.7, indicating a high severity. The EPSS score is less than 1%, implying a low likelihood of exploitation in the near term, and the issue is not yet tracked in CISA’s KEV catalog. Exploitation does not require user interaction; a local or otherwise low‑privileged attacker can trigger the bypass through the affected component’s authorization logic.