CVE-2019-15511

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is installed. All GOG Galaxy versions before 1.2.60 and all corresponding versions of GOG Galaxy 2.0 Beta are affected.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxyThird Party Advisory, Vendor Advisory
https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issuesRelease Notes, Vendor Advisory
https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxyThird Party Advisory, Vendor Advisory
https://support.gog.com/hc/en-us/articles/360025458833-GOG-GALAXY-2-0-updates-and-known-issuesRelease Notes, Vendor Advisory

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155137.5An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR0 CVE-2019-155145.3The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is No CVE-2019-155156.5Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-155167.5Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.CVE-2019-155175.5jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.CVE-2019-155185.3Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.CVE-2019-155199.8Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.CVE-2019-15523.3OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in T CVE-2019-155205.3comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.CVE-2019-155219.8Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing a CVE-2019-155229.8An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when t CVE-2019-155235.3An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of th