PT-2025-52454 · Galette · Galette

Gagnieray · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-53922

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Galette versions 1.1.4 through 1.1.9

Description Galette is a membership management web application designed for non-profit organizations. A logged-in group manager can bypass intended restrictions related to Contributions and Transactions.

Recommendations Update to version 1.2.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-53922

GHSA-5JP7-5C38-3PV6

Affected Products

Galette

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53922.json · Exploit
• https://github.com/galette/galette/security/advisories/GHSA-5jp7-5c38-3pv6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53922 · Security Note
• https://twitter.com/CVEnew/status/2002099149693710819 · Twitter Post