TI-2021-18092 Aliases CVE-2021-41260

Missing CSRF checks in Galette

LOW 38CWE-352Published 2021-12-16 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue.

Why it matters now

EPSS 0.00448 39th percentileScored 2026-11-07

Fix Fixed galette (galette): 0.9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
galette	galette	before 0.9.6	0.9.6	Patch available	CNA

galette Vendorgalette Affected before 0.9.6 Fixed in 0.9.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:galette:galette::::::::	before 0.9.6	Vulnerable	galette

cpe:2.3:a:galette:galette:*:*:*:*:*:*:*:* Versions before 0.9.6 Vulnerable ·galette

Remediation

Fix · CNA galette (galette) Fixed in 0.9.6

Timeline

2026-10-02 Threatist record created from CVE-2021-41260

References

Patch 1

https://github.com/galette/galette/commit/a5602bca2566f1be370631c3ab2d40feedd4b3ad

Advisory 1

https://github.com/galette/galette/security/advisories/GHSA-hw28-c7px-xqm5

TI-2024-16278 Galette public pages accessibility restriction CVSS 3.1HIGH 7.5
TI-2025-35895 Galette has groups managers access control bypass on Members CVSS 4.0LOW 2.1
TI-2021-18094 SQL Injection in Galette CVSS 3.1HIGH 8.8
TI-2021-18093 Stored Cross-site Scripting in Galette CVSS 3.1HIGH 8.1
TI-2021-04419 Several stored XSS CVSS 3.1MEDIUM 6.8
TI-2025-31034 Galette is vulnerable to XSS through Document Type CVSS 4.0MEDIUM 5.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences