TI-2021-18094 Aliases CVE-2021-41262

SQL Injection in Galette

MEDIUM 40CWE-89Published 2021-12-16 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soon as possible. There are no known workarounds.

Why it matters now

EPSS 0.01086 65th percentileScored 2026-11-07

Fix Fixed galette (galette): 0.9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
galette	galette	before 0.9.6	0.9.6	Patch available	CNA

galette Vendorgalette Affected before 0.9.6 Fixed in 0.9.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:galette:galette::::::::	before 0.9.6	Vulnerable	galette

cpe:2.3:a:galette:galette:*:*:*:*:*:*:*:* Versions before 0.9.6 Vulnerable ·galette

Remediation

Fix · CNA galette (galette) Fixed in 0.9.6

Timeline

2026-10-02 Threatist record created from CVE-2021-41262

References

Patch 1

https://github.com/galette/galette/commit/8e940641b5ed46c3f471332827df388ea00a85d3

Advisory 1

https://github.com/galette/galette/security/advisories/GHSA-936f-xvgq-fg74

TI-2024-16278 Galette public pages accessibility restriction CVSS 3.1HIGH 7.5
TI-2025-35895 Galette has groups managers access control bypass on Members CVSS 4.0LOW 2.1
TI-2021-18092 Missing CSRF checks in Galette CVSS 3.1HIGH 8.8
TI-2021-18093 Stored Cross-site Scripting in Galette CVSS 3.1HIGH 8.1
TI-2021-04419 Several stored XSS CVSS 3.1MEDIUM 6.8
TI-2025-31034 Galette is vulnerable to XSS through Document Type CVSS 4.0MEDIUM 5.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences