CVE-2026-67921
Received Received - Intake

Cross-Site Request Forgery in Halo CMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: MITRE

Description
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-67921
EUVD
EUVD-2026-61145

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
halo_cms halo_cms to 2.25.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Halo CMS versions up to 2.25.4. It exists due to two misconfigurations: a CORS policy allowing any origin with credentials enabled and CSRF protection being bypassed for API endpoints. This combination lets attackers perform CSRF attacks from any website, bypassing browser security protections.

Detection Guidance

Check Halo CMS versions up to 2.25.4 for misconfigured CORS and CSRF settings. Review CorsConfigurer.java and CsrfConfigurer.java files for permissive CORS origins and excluded API endpoints. Monitor network traffic for unauthorized cross-origin requests or CSRF token absence in API calls.

Impact Analysis

An attacker could exploit this to perform actions on your behalf without your knowledge, such as creating admin users, changing passwords, installing malicious plugins for remote code execution, modifying site content, or stealing data. The impact ranges from full system compromise to data theft.

Mitigation Strategies

Upgrade Halo CMS to a version beyond 2.25.4. Restrict CORS origins to trusted domains only. Enable CSRF protection for all API endpoints. Replace session-based authentication with Bearer token authentication where possible. Audit user accounts and plugins for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart