What is the CVSS score of CVE-2026-36759?

CVE-2026-36759 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Halo CMS CVE-2026-36759

EUVD-2026-26385 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-30 mitre

SSRF N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 18:45 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 30, 2026 - 16:15 euvd

EUVD-2026-26385

Analysis Generated

Apr 30, 2026 - 16:15 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

AnalysisAI

Server-side request forgery (SSRF) in Halo v2.22.14's /themes/{name}/upgrade-from-uri endpoint allows authenticated attackers to scan internal network resources and services by submitting crafted GET requests, enabling reconnaissance of backend infrastructure without direct network access.

Technical ContextAI

Halo is a content management system that exposes a theme upgrade endpoint vulnerable to SSRF due to insufficient validation of user-supplied URIs. The vulnerability exists in CWE-918 (Server-Side Request Forgery), where the application processes attacker-controlled URL parameters and makes backend HTTP requests without proper allowlist controls. This permits an authenticated user to specify arbitrary target URIs (internal IP addresses, localhost services, private cloud metadata endpoints, etc.) that the server will attempt to access and return response data from, effectively using the application as a proxy to bypass network segmentation.

RemediationAI

Upgrade Halo to a patched version released after v2.22.14; exact patch version number not confirmed in available data-check the official Halo GitHub releases page immediately for a security update. If an upgrade is not immediately available, implement the following compensating controls: (1) Restrict network-level access to the /themes/{name}/upgrade-from-uri endpoint using a Web Application Firewall (WAF) or reverse proxy to allow only trusted sources or block entirely if theme upgrades are not actively used, (2) Implement strict URL allowlisting on the application side (if source code is accessible) to permit only whitelisted external domains for theme updates and explicitly deny internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, and cloud provider metadata endpoints), (3) Enforce network segmentation to limit the application server's outbound connectivity to only required external services, blocking access to internal infrastructure and metadata services, (4) Audit authentication logs and Halo access logs for suspicious /themes/*/upgrade-from-uri requests containing internal IP addresses or localhost URIs, and (5) Disable the theme upgrade feature entirely if not operationally necessary, reducing the attack surface. Trade-off: WAF blocking impacts legitimate theme updates; URL allowlisting requires maintenance as new themes are added; segmentation may complicate legitimate internal API calls.