CVE-2021-41260highCWE-352

CVE-2021-41260: high-severity vulnerability in galette

Missing CSRF checks in Galette

Published · Updated

Follow this CVE+ Monitor galette

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected products
galette · galette
Related CVEs — galette

In the same product, most dangerous first.

CVE-2021-41262HIGHSQL Injection in GaletteEPSS 1.1%CVE-2021-21319MEDIUMSeveral stored XSSEPSS 0.9%CVE-2024-24761HIGHGalette public pages accessibility restrictionEPSS 0.6%CVE-2021-41261HIGHStored Cross-site Scripting in GaletteEPSS 0.6%CVE-2025-58052LOWGalette has groups managers access control bypass on MembersEPSS 0.3%CVE-2025-58053MEDIUMGalette has a privilege escalation vulnerabilityEPSS 0.3%