CVE-2025-58053
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Galette is a membership management web application for non-profit organizations. Prior to version 1.2.0, while updating any existing account with a self-forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
Risk Assessment
Risk of privilege escalation, potentially allowing an attacker to gain administrative access and compromise organizational data.
Recommendation
Update Galette to version 1.2.0 or later and monitor account activity for unusual requests.
Other vulnerabilities in Galette
See all- CVE-2025-53922Medium
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
- CVE-2025-48884Medium
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
- CVE-2025-48076Medium
Galette versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
Original NVD description (English source)
Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS