CVE-2026-67921: CSRF
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Halo CMSto a version that resolves this vulnerability.Fixed in 2.25.4
Event History
Frequently Asked Questions
Which Halo CMS deployments are identified as affected?
Halo CMS versions up to 2.25.4 are identified as affected. The available information does not state whether any particular deployment configuration, authentication setting, or default installation state changes exposure.
What does an attacker need to exploit this issue?
An attacker must be able to send a crafted cross-site request to a target using the affected Halo CMS instance. The provided information describes the attacker as remote but does not specify required victim interaction, privileges, or authentication conditions.
How can defenders determine whether exploitation has occurred or mitigate the issue before patching?
The data identifies the CorsConfigurer.java and CsrfConfigurer.java components as involved. It does not provide detection indicators, logs, request patterns, or a workaround for deployments that cannot be patched immediately.