This vulnerability affects halo-dev Halo up to versions 2.25.4 and 2.26.1. It is caused by improper neutralization in an unspecified function of the ReplyNotificationSubscriptionHelper.java file, part of the SpEL Handler component. The flaw allows remote attackers to perform an attack that bypasses neutralization controls, potentially leading to security issues. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed. The vendor was contacted but did not respond, and no patch or fix is currently documented.

The vulnerability allows remote attackers to exploit improper neutralization in the affected component, which may lead to partial compromise of confidentiality, integrity, or availability as indicated by the CVSS vector. The exact impact is not detailed beyond the improper neutralization issue. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, consider applying compensating controls if possible, such as restricting access to vulnerable components or applying input validation at other layers.