PT-2025-52485 · Galette · Galette

Gagnieray · Published 2025-12-19 · Updated 2026-01-05 · CVE-2025-58052

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Galette versions 0.9.6 through 1.1.9

Description Galette is a membership management web application designed for non-profit organizations. Individuals with the 'group manager' role can circumvent intended restrictions, enabling unauthorized access and modifications despite the presence of role-based access controls. Exploitation is limited to those with initial privileged access, such as malicious insiders or compromised group manager accounts.

Recommendations Update to version 1.2.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-58052

GHSA-GP9G-GF56-FCXX

Affected Products

Galette

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58052.json · Exploit
• https://github.com/galette/galette/security/advisories/GHSA-gp9g-gf56-fcxx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58052 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58052 · Vendor Advisory
• https://t.me/cveNotify/147744 · Telegram Post
• https://twitter.com/CVEnew/status/2002099144857657612 · Twitter Post
• https://t.me/CVEtracker/40289 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002222801831252021 · Twitter Post
• https://t.me/cveNotify/146366 · Telegram Post