CVE-2026-61502 describes a CSRF vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 where state-changing API requests are accepted via GET requests, which are exempt from anti-CSRF header validation. This flaw enables remote attackers to perform unauthorized administrative actions by causing an authenticated administrator's browser to issue crafted GET requests. Additionally, on default installations, attackers originating from the server's own machine can exploit this without any credentials. The vulnerability can lead to code execution through administrative control.

An attacker can perform unauthorized administrative actions such as creating accounts and changing configurations, potentially leading to remote code execution. This compromises the integrity and control of the affected HFS server. The vulnerability requires either a logged-in administrator to be tricked into visiting a malicious URL or local access on default installations without credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the administrative interface, avoid using default installations without credentials, and educate administrators to avoid clicking untrusted links. Monitor for updates from the vendor regarding official patches or mitigations.