CVE Catalog
CVE-2026-67921
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk0.24%
16th percentile - higher than 16% of all known CVEs
Summary
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.
Risk Assessment
An attacker can exploit CSRF to perform unauthorized actions in the context of a logged-in administrator, potentially leading to full CMS compromise.
Recommendation
Update Halo CMS to a patched version and implement CSRF protections such as tokens.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.