Galette has access control bypass
Priority LOW 8CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix Fixed galette (galette): 1.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA galette (galette) Fixed in 1.2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53922
References
More Galette vulnerabilities
- TI-2024-16278 Galette public pages accessibility restriction CVSS 3.1HIGH 7.5
- TI-2025-35895 Galette has groups managers access control bypass on Members CVSS 4.0LOW 2.1
- TI-2021-18094 SQL Injection in Galette CVSS 3.1HIGH 8.8
- TI-2021-18092 Missing CSRF checks in Galette CVSS 3.1HIGH 8.8
- TI-2021-18093 Stored Cross-site Scripting in Galette CVSS 3.1HIGH 8.1
- TI-2021-04419 Several stored XSS CVSS 3.1MEDIUM 6.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences