CVE-2026-67921
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 18, 2026
Vendor
unknown
Description
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.