Vulnerabilidades de Galette
CVEs publicadas que afetam produtos de Galette: 5 registro(s), com severidade, exploração e correções.
CVE-2025-58053
Crítica · 9.8
CWE-269 19/12/2025
Galette has a privilege escalation vulnerability
Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
CVE-2025-58052
Alta · 8.1
CWE-863 19/12/2025
Galette has groups managers access control bypass on Members
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
CVE-2025-53922
Média · 4.9
CWE-863 19/12/2025
Galette has access control bypass
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
CVE-2025-48884
Média · 6.1
CWE-79 04/11/2025
Galette is vulnerable to XSS through Document Type
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
CVE-2025-48076
Média · 5.4
CWE-79 04/11/2025
Galette is vulnerable to Cross-site Scripting
Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.