Incorrect Authorization in Adobe ColdFusion Allows Code Execution

Executive Summary

This vulnerability affects ColdFusion versions 2023.19, 2025.8, and earlier. It is an Incorrect Authorization vulnerability that allows an attacker to execute arbitrary code within the context of the current user.

A high-privileged attacker can exploit this flaw to gain elevated access or control over the victim's account or session without requiring any user interaction.

The scope of the vulnerability is changed, meaning it can affect resources beyond the initially intended boundaries.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to arbitrary code execution with the privileges of the current user.

If the attacker has high privileges, they could gain elevated access or full control over the victim's account or session.

This could result in unauthorized actions, data compromise, or further system compromise without any user interaction.

Useful 0 Not Useful 0