PT-2025-52492 · Galette · Galette

Trasher · Published 2025-12-19 · Updated 2026-01-05 · CVE-2025-58053

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Galette versions prior to 1.2.0

Description Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, it was possible to gain higher privileges by updating an existing account using a self-forged POST request. The issue was addressed in version 1.2.0. The application accepts POST requests to update account information, and improper validation of the request data allowed an attacker to manipulate account privileges. The vulnerable operation involves submitting a crafted POST request to modify account details, potentially elevating the user's role within the system.

Recommendations Update to version 1.2.0 or later.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-58053

GHSA-R7X8-6R56-498R

Affected Products

Galette

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58053.json · Exploit
• https://github.com/galette/galette/security/advisories/GHSA-r7x8-6r56-498r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58053 · Security Note
• https://t.me/CVEtracker/40290 · Telegram Post
• https://t.me/cveNotify/147745 · Telegram Post
• https://twitter.com/CVEnew/status/2002099143788097829 · Twitter Post
• https://t.me/cveNotify/146367 · Telegram Post