The 'scope changed' designation in this CVE is the signal detail. It means the vulnerability doesn't just escalate privilege within Adobe Campaign—it crosses into a different component's authority. Given that ACC runs a server-side JavaScript engine for workflow automation (documented, intended functionality), the most likely interpretation is that an authorization failure in the campaign management layer can land code execution in that JavaScript engine context. That's not a permission check failing—it's a missing containment boundary between business logic and privileged execution.
The 'no user interaction required' element means this is exploitable via automated tools or scripted API calls against endpoints that already accept the attacker's authenticated session. If you have a campaign operator account, an API key, or an integration service account, you can likely reach the vulnerable code path without any social engineering or user assistance.
For defenders: prioritize identifying which ACC user roles and API keys have access to workflow automation and custom script execution. The vulnerability likely manifests when untrusted input reaches a code path that was assumed to only receive pre-validated context. Audit your ACC deployments for long-lived service accounts and API tokens with broad permissions—these are your exposure window anchors. Because exploitation is stealthy (legitimate session, no anomalous login patterns), focus on application-layer telemetry that flags when campaign workflow requests trigger engine execution outside the expected permission scope. Consider this a supply-chain-class risk: ACC sits between CRMs, customer databases, and marketing execution layers. Code execution in the JavaScript engine context potentially exposes integration credentials and customer PII stored within the platform.