Vulnerability Description
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Galette | Galette | < 1.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/galette/galette/security/advisories/GHSA-gp9g-gf56-fcxxExploitVendor Advisory
FAQ
What is CVE-2025-58052?
CVE-2025-58052 is a vulnerability with a CVSS score of 8.1 (HIGH). Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restriction...
How severe is CVE-2025-58052?
CVE-2025-58052 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-58052?
Check the references section above for vendor advisories and patch information. Affected products include: Galette Galette.