{"apiVersion":"1.0","identifier":"CVE-2026-67921","description":"Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.","publishedAt":"2026-08-18T18:19:25","lastModifiedAt":"2026-08-20T17:19:31","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67921","cvssScore":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","epssProbability":0.00199,"riskScore":0.95,"affectedProduct":"Halo CMS","affectedVersions":"<=2.25.4","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-67921","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-67921","en":"https://www.redsauce.net/en/cves/CVE-2026-67921","fr":"https://www.redsauce.net/fr/cves/CVE-2026-67921","pt":"https://www.redsauce.net/pt/cves/CVE-2026-67921","de":"https://www.redsauce.net/de/cves/CVE-2026-67921","sk":"https://www.redsauce.net/sk/cves/CVE-2026-67921","el":"https://www.redsauce.net/el/cves/CVE-2026-67921"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-67921"}}