{"id":"CVE-2026-106620","published":"2026-10-13T21:17:31.263","lastModified":"2026-10-15T18:42:40.420","description":"ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-863"],"vendors":["adobe"],"products":["coldfusion"],"references":[{"url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ColdFusion contains an Incorrect Authorization vulnerability (CWE-863) that allows low-privileged attackers to bypass security controls and gain unauthorized write access. This critical flaw enables a security feature bypass without requiring user interaction, potentially leading to arbitrary file writes or configuration changes.","exploitability":"Exploitation is relatively straightforward for a low-privileged attacker who can access the application, requiring no user interaction and leveraging the authorization bypass to escalate privileges to write access.","blast_radius":"If exploited, this vulnerability could allow attackers to perform unauthorized file writes, potentially leading to code execution through configuration changes or direct file manipulation in the ColdFusion application environment.","remediation":"Upgrade to ColdFusion 2023 Release 1 or later, as this version contains the fix for CVE-2026-106620.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","coldfusion","authorization","write-access"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:53:56.698Z"}}