Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-61502Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests

Medium 4.3

In plain English

A medium-severity cross-site request forgery in hfs from rejetto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

Affected products (as reported)

Vendor	Product	Versions
rejetto	hfs	3.0.0 – before 3.2.1

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

hfs v3.2.1 Release Notes release-notes, patch
https://www.vulncheck.com/advisories/rejetto-hfs-cross-site-request-forgery-via-get-requests third-party-advisory