I've you've searched other posts, they've not doubt recommended that you URL Encode your parameters, put the access token in a <cfhttpparam>, specify a content type, etc.
But, there's one ColdFusion specific "issue" that many posts neglect.
That "issue" is the way ColdFusion stores structure keys – all uppercase.
If you've Serialized a Structure to a JSON object, the keys will be all uppercase. Furthermore, if you are sending parameters that come from a structure, they need to be properly "cased".
See the example below:
<cfset oRequest[1] = {method = "GET", relative_url = "me"}>
<cfset oRequest[2] = {method = "GET", relative_url = "me/friends?limit=50"}>
<cfset oRequest = SerializeJSON(oRequest)>
<cfset oRequest = Replace(oRequest, "METHOD", "method", "ALL")>
<cfset oRequest = Replace(oRequest, "RELATIVE_URL", "relative_url", "ALL")>
<cfhttp url="https://graph.facebook.com" method="POST">
<cfhttpparam type="url" name="access_token" value="#arguments.access_token#">
<cfloop collection="#postParams#" item="param">
<cfhttpparam type="url" name="#lcase(param)#" value="#postParams[param]#">
</cfloop>
</cfhttp>
Note the lcase wrapping the parameter. This may not apply to all parameters, but it's important to note that the parameter is case-sensitive.