CVE-2026-67921

CriticalCVSS 9.3

Published: 18/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.

Risk Assessment

An attacker can exploit CSRF to perform unauthorized actions in the context of a logged-in administrator, potentially leading to full CMS compromise.

Recommendation

Update Halo CMS to a patched version and implement CSRF protections such as tokens.

Other vulnerabilities in Halo CMS

CVE-2025-60898Medium
An unauthenticated server-side request forgery (SSRF) vulnerability exists in the Thumbnail via-uri endpoint of Halo CMS 2.21. A remote attacker can force the server to make HTTP requests to attacker-controlled URLs, including internal network addresses.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS