Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2025-58052 (CVSS 8.1) - Galette membership management app privilege escalation. Group managers can bypass role restrictions for unauthorized access/changes. Affects v0.9.6-1.1.x. Patch to v1.2.0 now. #CVE #PatchNow #ThreatIntel https://t.co/TBezJPVhJ7
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | galette | galette | - | - | - |