CVE-2025-58053 is a critical (CVSS 9.8) privilege escalation in Galette, the membership management web application for non profit organizations. Before version 1.2.0, a forged POST request that updates an existing account can grant higher privileges. Upgrade to 1.2.0 and review who holds administrator rights.
What's affected
Galette versions before 1.2.0, per the record and the GitHub advisory. The fixed version is 1.2.0.
The advisory is brief. It describes the problem as privilege escalation through an account update request and tells users to upgrade to 1.2.0.
How to check if you're exposed
Galette is a self hosted PHP application, so the version comes from your installation. Look at the version shown in the application's footer or administration pages, or at the release you deployed.
If you cannot find it there, compare the files on disk with the release archive you installed. Then list your administrator and staff accounts and compare them with the people who should have those roles.
What to do now
- Record the Galette version on every instance you host.
- Upgrade to 1.2.0 or later following the project's upgrade documentation, after taking a backup of the database and files.
- Review the list of accounts with administrator or staff rights and remove any you do not recognise.
- Review member records changed during the exposure window, since an elevated account could have edited data.
- Review your logs for requests to the affected area from accounts or addresses that do not normally use it.
- Test with a low privilege account after patching to confirm the restriction now holds.
Why it matters
The weakness is improper privilege management. The application accepted a request to update an account and did not stop the caller from changing fields that control their own level of access. The fix is to make the server decide which fields a given user may change, rather than trusting whatever the form submits.
Membership tools hold names, addresses and payment related notes for volunteers and members, so an unnoticed admin account is a real concern even for a small organization.
The record classifies the weakness as CWE-269 (Improper Privilege Management).
Access control bugs are quiet. Nothing crashes and no error appears, because the application does exactly what the request asked. The flaw is that the server never asked whether the caller was allowed to ask.
The durable fix is to check authorization on the server for every action, tied to the identity of the caller, and never to rely on what the browser interface chooses to show. Reviewing a few sensitive endpoints with a second account of lower privilege is a cheap way to find this class of problem before someone else does.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
What do I check after upgrading?
Review all administrator and staff accounts. If the flaw was used before you patched, a new elevated account would remain after the upgrade.
Which version fixes it?
Galette 1.2.0.
Sources
Last reviewed: 18 October 2026.
