https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-58053.htmlhttps://patchthecve.com/cve/CVE-2025-58053.htmlTue, 13 Oct 2026 11:10:00 +0000CRITICAL 9.8: Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.https://patchthecve.com/cve/CVE-2025-58052.htmlhttps://patchthecve.com/cve/CVE-2025-58052.htmlTue, 13 Oct 2026 11:10:00 +0000HIGH 8.1: Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privilegedhttps://patchthecve.com/cve/CVE-2025-53922.htmlhttps://patchthecve.com/cve/CVE-2025-53922.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 4.9: Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.https://patchthecve.com/cve/CVE-2025-48884.htmlhttps://patchthecve.com/cve/CVE-2025-48884.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 6.1: Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.https://patchthecve.com/cve/CVE-2025-48076.htmlhttps://patchthecve.com/cve/CVE-2025-48076.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.https://patchthecve.com/cve/CVE-2024-24761.htmlhttps://patchthecve.com/cve/CVE-2024-24761.htmlWed, 17 Jun 2026 07:14:48 +0000HIGH 7.5: Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone