CVE-2025-58052lowCWE-863

CVE-2025-58052: falha de baixa gravidade em galette

Galette has groups managers access control bypass on Members

Publicada em

Seguir esta CVE+ Monitorar galette

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.3%
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
galette · galette
CVEs relacionadas — galette

No mesmo produto, das mais perigosas para as menos.

CVE-2021-41262HIGHSQL Injection in GaletteEPSS 1.1%CVE-2021-21319MEDIUMSeveral stored XSSEPSS 0.9%CVE-2024-24761HIGHGalette public pages accessibility restrictionEPSS 0.6%CVE-2021-41261HIGHStored Cross-site Scripting in GaletteEPSS 0.6%CVE-2021-41260HIGHMissing CSRF checks in GaletteEPSS 0.4%CVE-2025-58053MEDIUMGalette has a privilege escalation vulnerabilityEPSS 0.3%