---
id: CVE-2025-58052
title: >-
  Galette is a membership management web application for non profit
  organizations
summary: >-
  Galette is a membership management web application for non profit
  organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers
  with group manager role can bypass intended restrictions allowing unauthorized
  access and ch…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-863
vendor: galette
product: galette
affected:
  - galette < 1.2.0
patched:
  - galette 1.2.0
published: '2025-12-19'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-58052'
references:
  - url: 'https://github.com/galette/galette/security/advisories/GHSA-gp9g-gf56-fcxx'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00322
epssPercentile: 0.23387
ingestedAt: '2026-10-13T11:23:51.146Z'
---

## Overview

Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.

## Affected

- `galette < 1.2.0`

## Remediation

Upgrade past the affected range:

- `galette 1.2.0`