CVE-2025-58052
Galette has groups managers access control bypass on Members
- State
- Published
- Severity
- 2.1 Low
- Published
- Dec 19, 2025
- Updated
- Dec 19, 2025
- Reserved
- Aug 22, 2025
Description
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.1 Low | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | GitHub_M |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
galettegalette |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.