Rejetto HFS versions 3.0.0 through 3.2.0 accept state-changing API requests via the GET method and exempt these GET requests from anti-CSRF header validation. This design flaw enables remote attackers to perform unauthorized administrative actions by causing a logged-in administrator's browser to access a maliciously crafted URL. Additionally, on default installations, attackers originating from the server's local machine can exploit this vulnerability without any credentials. These actions include account creation and configuration changes that may lead to remote code execution.

An attacker can perform unauthorized administrative actions remotely, including creating accounts and modifying configurations. This can escalate to code execution on the affected system. The vulnerability affects authenticated administrators via CSRF and unauthenticated attackers on default installations from the server's local machine, increasing the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative interface, avoid using default installations without additional protections, and educate administrators to avoid clicking untrusted links while logged in. Monitor for updates from the vendor regarding patches or official mitigations.