CVE-2025-48076
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Galette versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
Risk Assessment
A malicious user could execute scripts in other users' browsers, potentially leading to session hijacking. Non-profit organizations using Galette for membership management are affected.
Recommendation
Upgrade Galette to version 1.2.0 or later. Restrict group name editing privileges to trusted users.
Other vulnerabilities in Galette
See all- CVE-2025-58053Critical
Galette is a membership management web application for non-profit organizations. Prior to version 1.2.0, while updating any existing account with a self-forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
- CVE-2025-53922Medium
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
- CVE-2025-48884Medium
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
Original NVD description (English source)
Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS