Hi Francisco,
It is easy to get lost in the complexity of ColdBox at times, but sometimes knowing is the key.
MVC frameworks are considered entry points into the Controller, ColdFusion doesn’t care about the request as it will always try to execute what it know, regardless of the source. What the means is that the same rules apply for handlers in ColdBox.
So with that it means you could be making it as simple as creating a remote handler, return what you need to in the format that you need.
Another option is that ColdBox supports Rest as well, and you can lock the request down to simple CRUD with permissions on all if need be.