CVE-2024-24761

Published: Mar 6, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone. Version 1.0.2 fixes this issue.

Affected (2)

Products: Galette: Galette

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Galette Galette	Version 1.0.0
Galette Galette	Version 1.0.1

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb

Source: security-advisories@github.com

Patch

https://github.com/galette/galette/security/advisories/GHSA-jrqg-mpwv-pxpv

Source: security-advisories@github.com

Vendor Advisory

https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/galette/galette/security/advisories/GHSA-jrqg-mpwv-pxpv

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.