CVE-2025-49536 HIGH

CVE-2025-49536: ColdFusion | Incorrect Authorization (CWE-863)

Vendor Adobe
Product ColdFusion
Weakness CWE-863 · Incorrect authorization
Published July 8, 2025
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.

Key dates

02Disclosure timeline

July 8, 2025 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-45718 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows CVE-2020-15251 Privilege Escalation in Channelmgnt plug-in for Sopel CVE-2026-31991 OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist CVE-2021-39321 Sassy Social Share 3.3.23 PHP Object Injection CVE-2026-33330 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback