CVE-2025-58052 Galette has groups managers access control bypass on Members

What is CVE-2025-58052?

CVE-2025-58052 is a low-severity vulnerability in galette, published on 19 Dec 2025.

Official description

Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.

Weakness: CWE-863

Which versions are affected by CVE-2025-58052?

It affects 1 product.

Products include Galette Galette.

How do I fix CVE-2025-58052?

No fix has been published for CVE-2025-58052 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-58052 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58052 exists.

Other vulnerabilities in galette

• CVE-2021-41262 SQL Injection in Galette High 8.8
• CVE-2021-41260 Missing CSRF checks in Galette High 8.2
• CVE-2021-41261 Stored Cross-site Scripting in Galette High 8.1
• CVE-2024-24761 Galette public pages accessibility restriction High 7.5
• CVE-2021-21319 Several stored XSS Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gp9g-gf56-fcxx, UBUNTU-CVE-2025-58052.