CVE-2024-24761 Galette public pages accessibility restriction
Attackers can access restricted public pages intended for administrators or staff due to incorrect default access controls in Galette.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24761?
CVE-2024-24761 is a high-severity missing authorization vulnerability in galette, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone. Version 1.0.2 fixes this issue.
Weakness: CWE-863
Which versions are affected by CVE-2024-24761?
It affects 1 product.
Products include Galette Galette.
How do I fix CVE-2024-24761?
No fix has been published for CVE-2024-24761 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-24761 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24761 exists.
Other vulnerabilities in galette
Sources
Also known as GHSA-jrqg-mpwv-pxpv.