galette vulnerabilities
CVEs whose affected-version data names the galette package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2025-58053Critical· 9.8Galette is a membership management web application for non profit organizations
Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
CVE-2025-58052High· 8.1Galette is a membership management web application for non profit organizations
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and ch…
CVE-2025-53922Medium· 4.9Galette is a membership management web application for non profit organizations
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transac…