CVE-2026-61502: hfs 3.0.0 to before 3.2.1

Affected technology

hfs · 3.0.0 to before 3.2.1
rejetto

Description’s affected range: through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and availability impact as none; integrity impact as low.