The vulnerability arises because RClone Manager starts a local rclone rcd service with deactivated authentication and relaxed CORS settings ("--rc-no-auth", "--rc-allow-origin *"). A user who opens a malicious web page can exploit the browser’s cross‑origin policy to issue arbitrary HTTP requests to the local API. The attacker can retrieve stored storage credentials, read or modify files accessible to the user, and potentially exfiltrate or upload data. The advisory notes that command‑execution via the API is unconfirmed, leaving the possibility of higher impact uncertain.

The affected system is the Zarestia‑Dev rclone‑manager application. Versions prior to 0.2.7 expose the vulnerable daemon; version 0.2.7 and later implement authentication for the rcd service and patch the issue.

Risk assessment indicates a CVSS score of 9.6, denoting critical severity. The EPSS score is not available, but the lack of authentication combined with a trivial user interaction (visiting a malicious page) makes exploitation likely, though the exact probability is unknown. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, yet its mechanics and high severity warrant immediate attention.