Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2021-41262: Galette Prior to 0.9.6 Allows Members to Access Sensitive Data
CVE-2021-41262 · published 4 years ago
Summary
Galette's older versions can let members access sensitive information. This is a security risk because it could allow malicious members to see or change data they shouldn't. To protect your organization, please upgrade to version 0.9.6 as soon as possible.
What to do
- Update galette galette to version 0.9.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| galette | galette |
< 0.9.6 cpe:2.3:a:galette:galette:*:*:*:*:*:*:*:* |
Original advisory text
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" p...
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soon as possible. There are no known workarounds.
References
- https://github.com/galette/galette/commit/8e940641b5ed46c3f471332827df388ea00a85... Patch Third Party Advisory
- https://github.com/galette/galette/security/advisories/GHSA-936f-xvgq-fg74 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published16 Dec 2021
Updated4 Nov 2026
First seen9 Jul 2026
Track software like this
Free during beta