CVE-2026-67921 in Halo
Summary
by MITRE • 08/18/2026
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw represents a critical misconfiguration within the web application framework of Halo CMS, specifically affecting versions prior to release 2.25.4. The vulnerability stems from an improper implementation of Cross-Site Request Forgery protections in conjunction with Cross-Origin Resource Sharing policies. In modern web architectures, securing state-changing requests requires robust validation mechanisms to ensure that incoming HTTP requests originate from trusted sources and possess valid authentication tokens. However, the interaction between the CorsConfigurer and CsrfConfigurer components in these specific versions fails to enforce strict origin verification or token binding correctly. This architectural weakness creates a scenario where an attacker can craft malicious web pages or scripts that trick authenticated users into performing unintended actions on the Halo CMS instance without their knowledge or consent.
From a technical perspective, the core issue lies in how the application handles preflight requests and subsequent state-changing operations such as POST, PUT, or DELETE methods. When Cross-Origin Resource Sharing is enabled to allow certain origins, the corresponding CSRF protection mechanism must be equally rigorous to prevent abuse. In this case, the configuration logic allows for a bypass where an attacker can exploit the browser's automatic inclusion of credentials in cross-origin requests if not properly restricted by the server-side validation logic. By manipulating the Origin header or exploiting inconsistencies in how the CsrfConfigurer validates incoming tokens against session data, a remote actor can successfully submit forged requests that appear legitimate to the backend system. This failure effectively neutralizes one of the primary defenses against automated attack scripts running from malicious third-party domains.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution and unauthorized administrative actions. Since Halo CMS serves as a content management platform, successful exploitation allows an attacker to manipulate site configurations, inject malicious plugins or themes, alter user accounts, or exfiltrate sensitive data stored within the system. If the compromised account possesses elevated privileges, which is common in default installations where administrators are often the primary users, the attacker gains full control over the web application environment. This can lead to complete server compromise if the CMS allows for file uploads that result in remote code execution, or through integration with other vulnerable services. The ability to execute arbitrary commands effectively turns a simple CSRF flaw into a gateway for broader system infiltration and data breach scenarios.
This vulnerability aligns closely with CWE-352, which defines Cross-Site Request Forgery as the inclusion of untrusted data in state-changing requests without adequate validation mechanisms. Furthermore, it maps to MITRE ATT&CK technique T1089, Disabling Security Tools or Software, and potentially T1190, Exploiting Public-Facing Application, depending on how the attacker leverages the forged requests for initial access or persistence. The lack of proper origin checking in conjunction with weak CSRF token validation exemplifies a common pattern where security controls are implemented but not hardened against sophisticated evasion techniques that exploit configuration ambiguities between different security modules within an application framework.
To mitigate this risk, immediate action is required to upgrade the Halo CMS installation to version 2.25.4 or any later release where these configuration issues have been addressed by the development team. Administrators should verify that their deployment environment enforces strict Content Security Policy headers and ensures that CORS settings do not inadvertently whitelist wildcard origins for state-changing methods. Additionally, implementing additional layers of defense such as SameSite cookie attributes set to Strict or Lax can provide a browser-level safeguard against CSRF attacks even if server-side configurations are imperfect. Regular security audits focusing on the interaction between authentication modules and request handling components will help prevent similar misconfigurations in future deployments.