VYPR
← All advisories
High severity8.1NVD Advisory· Published Dec 19, 2025· Updated Apr 29, 2026

CVE-2025-58052

CVE-2025-58052

Description

Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Galette/Galette2 versions
    cpe:2.3:a:galette:galette:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:galette:galette:*:*:*:*:*:*:*:*range: <1.2.0
    • (no CPE)range: >=0.9.6, <1.2.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.