Auth bypass in Galette
CVE-2025-58052
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
Vulnerability class: Broken Access Control
EPSS: 0.003 (20.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Galette — versions >= 0.9.6, < 1.2.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-58052?
- CVE-2025-58052 is a high-severity vulnerability in Galette, classified under Incorrect Authorization. CVSS score: 8.1/10. Published 2025-12-19.
- How severe is CVE-2025-58052?
- High severity. CVSS v3 base score is 8.1 out of 10.