CVE-2026-61502 | BDVDB-2026-347482 Detail

Description#

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-13Record published in the CVE List.
2. Version 22026-10-01Most recent update recorded in the CVE List.