ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low privileged attacker with local access leverage this to bypass security protections execute code. Exploitation of issue requires user interaction victim must be coerced into performing actions within the application scope is changed.