CVE-2026-67921

Halo CMS (versions up to 2.25.4) contains a CSRF vulnerability in CorsConfigurer.java and CsrfConfigurer.java allowing remote attackers to execute arbitrary code. A gist by "unpredictable21" documents the issue; upgrading beyond 2.25.4 is recommended, though no official fix version is explicitly ...