CVE-2026-67921: Halo CMS CSRF Vulnerability

CVE-2026-67921 Overview

CVE-2026-67921 is a Cross-Site Request Forgery (CSRF) vulnerability in Halo CMS versions up to and including 2.25.4. The flaw resides in the CorsConfigurer.java and CsrfConfigurer.java components, which govern cross-origin and CSRF protections in the application. A remote attacker can leverage this weakness to trick an authenticated user into submitting forged requests, resulting in arbitrary code execution. The vulnerability maps to CWE-352: Cross-Site Request Forgery and requires user interaction, such as visiting a malicious page while authenticated to Halo CMS.

Critical Impact
A successful CSRF attack against an authenticated Halo CMS administrator can lead to arbitrary code execution on the underlying application, with a scope change extending impact beyond the initial component.

Affected Products

Halo CMS versions up to and including 2.25.4
CorsConfigurer.java component
CsrfConfigurer.java component

Discovery Timeline

2026-08-18 - CVE-2026-67921 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-67921

Vulnerability Analysis

Halo CMS is an open-source content management system written in Java. The vulnerability arises from misconfigured security filters within CorsConfigurer.java and CsrfConfigurer.java. These classes control how the application validates cross-origin requests and enforces anti-CSRF tokens on state-changing endpoints. When these configurations are permissive or improperly scoped, sensitive administrative endpoints accept requests without proper origin or token validation.

An attacker crafts a malicious HTML page or link that, when visited by an authenticated Halo administrator, causes the browser to submit forged requests to the target Halo instance. Because the browser automatically attaches session cookies, the server processes the request as legitimate. The chain reaches arbitrary code execution by abusing administrative functionality reachable through the bypassed CSRF layer.

Root Cause

The root cause is insufficient CSRF protection in the Spring Security configuration classes shipped with Halo CMS. The CsrfConfigurer.java component fails to enforce token validation on all state-changing endpoints, while CorsConfigurer.java permits cross-origin requests from untrusted origins. The combination allows browser-initiated forged requests to reach privileged handlers.

Attack Vector

Exploitation requires network access to the Halo CMS instance and user interaction from an authenticated victim. The attacker hosts a crafted page containing a hidden form or JavaScript that issues requests to the Halo administrative API. When the victim visits the page while logged in, the requests execute in the security context of the victim. The scope change in the impact means code execution can extend beyond the initial application context. A public proof of concept is referenced in the GitHub Gist PoC Code, and the upstream project is available at the GitHub Repository for Halo.

No verified exploit code is reproduced here. Refer to the linked PoC for technical details of the request sequence.

Detection Methods for CVE-2026-67921

Indicators of Compromise

HTTP referer headers on administrative endpoints originating from external, untrusted domains
Unexpected POST, PUT, or DELETE requests to /apis/ administrative routes without matching CSRF tokens
New administrator accounts, plugins, or themes installed without corresponding audit-log entries from a legitimate admin session
Outbound network connections from the Halo JVM process to unfamiliar hosts following administrative actions

Detection Strategies

Inspect web server and reverse proxy logs for state-changing requests to Halo admin APIs that lack the expected X-XSRF-TOKEN header
Correlate authenticated admin session activity with the Origin and Referer headers to surface cross-origin submissions
Alert on installation of new plugins or themes on Halo instances outside of scheduled maintenance windows

Monitoring Recommendations

Enable verbose access logging on the reverse proxy in front of Halo and forward logs to a centralized analytics platform
Monitor the Halo application process for child process creation, which is uncommon during normal CMS operation and may indicate code execution
Track file writes to the Halo working directory, plugin directory, and theme directory for unauthorized modifications

How to Mitigate CVE-2026-67921

Immediate Actions Required

Upgrade Halo CMS to a version later than 2.25.4 once a fixed release is published by the maintainers
Restrict administrative access to Halo to trusted networks or through a VPN until patching is complete
Require administrators to use dedicated browser profiles when managing Halo, reducing exposure to malicious cross-origin pages

Patch Information

As of the last NVD update on 2026-08-20, consult the GitHub Repository for Halo for the latest release notes and security fixes addressing the CorsConfigurer.java and CsrfConfigurer.java components. Apply the vendor-supplied patch as soon as it is available.

Workarounds

Configure the upstream reverse proxy (for example, Nginx or Traefik) to reject requests to Halo administrative paths that lack a valid X-XSRF-TOKEN header
Enforce a strict SameSite=Strict attribute on Halo session cookies to prevent browsers from attaching them to cross-site requests
Restrict the CORS allow-list at the proxy layer to only the trusted origins that require access to Halo APIs

bash

# Nginx workaround: block cross-origin state-changing requests to Halo admin APIs
location /apis/ {
    if ($request_method ~ ^(POST|PUT|DELETE|PATCH)$) {
        if ($http_origin !~* ^https://halo\.example\.com$) {
            return 403;
        }
    }
    proxy_pass http://halo_backend;
}