CVE-2025-53922
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
Risk Assessment
A user with group manager privileges may perform unauthorized operations on contributions and transactions, potentially leading to data integrity issues.
Recommendation
Update Galette to version 1.2.0 or later.
Other vulnerabilities in Galette
See all- CVE-2025-58053Critical
Galette is a membership management web application for non-profit organizations. Prior to version 1.2.0, while updating any existing account with a self-forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
- CVE-2025-48884Medium
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
- CVE-2025-48076Medium
Galette versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
Original NVD description (English source)
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS