What is the CVSS score of CVE-2026-36758?

CVE-2026-36758 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Halo CVE-2026-36758

EUVD-2026-26384 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-30 mitre

SSRF N A

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 18:45 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

4.3 (MEDIUM)

EUVD ID Assigned

Apr 30, 2026 - 16:15 euvd

EUVD-2026-26384

Analysis Generated

Apr 30, 2026 - 16:15 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

MEDIUM 4.3

DescriptionCVE.org

A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

AnalysisAI

Server-side request forgery in Halo v2.22.14 /themes/-/install-from-uri endpoint allows authenticated attackers to scan internal resources and access sensitive network information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity and results in confidentiality impact through information disclosure of internal network topology and services.

Technical ContextAI

The vulnerability exists in the theme installation functionality of Halo (a content management system), specifically the /themes/-/install-from-uri endpoint. This endpoint is designed to fetch and install themes from external URIs but fails to properly validate or restrict the target URLs. The root cause is CWE-918 (Server-Side Request Forgery), which occurs when the application makes HTTP requests to user-controlled URLs without sufficient validation of the target host. An authenticated attacker can manipulate the URI parameter to force the server to make requests to internal network resources (localhost, private IP ranges, internal services) that would normally be inaccessible from the internet. This allows reconnaissance of internal services, metadata endpoints, and potentially sensitive configuration information.

RemediationAI

Upgrade Halo to a patched version released by the project maintainers. Check the official Halo repository (https://github.com/halo-dev/halo) for security advisories and releases that address CVE-2026-36758. If an immediate patch is unavailable, implement URL validation on the /themes/-/install-from-uri endpoint by maintaining a whitelist of allowed theme repository domains (e.g., only trusted CDNs or the official Halo theme marketplace) and blocking requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, ::1/128). Additionally, restrict network egress from the Halo application server using firewall rules to prevent it from reaching internal network resources, database servers, or cloud metadata endpoints. Implement robust authentication and access control for Halo admin accounts to reduce the number of users who can access the vulnerable endpoint. Monitor outbound HTTP/HTTPS requests from the Halo server for unusual destinations or metadata service access patterns.