The vulnerability is an improper access control flaw that allows an attacker to bypass authentication. By requesting an XSRF token without credentials, an unauthenticated user can then invoke remote procedure calls using a carefully crafted payload, potentially executing arbitrary actions within the Filr instance. The weakness is a classic authorization error (CWE‑862) and can compromise confidentiality and integrity of information and system resources.

OpenText Filr, versions up to and including 25.1.2, as identified by the vendor and the associated CPE string.

The CVSS score of 8.3 indicates a high severity, but the EPSS value of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is remote over the network: an attacker sends unauthenticated requests to obtain a token and then performs RPC calls. No additional prerequisites are mentioned in the advisory, so a simple network connection to the affected service suffices.