CVE-2021-41260

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412614.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412628.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412638.8rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications usi CVE-2021-412649.8OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may b CVE-2021-412658.8Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability i CVE-2021-412669.8Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versi CVE-2021-412676.5Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP com CVE-2021-412688.8Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP compon CVE-2021-412699.8cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected vers CVE-2021-41279.8An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thu CVE-2021-412706.5Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a CVE-2021-412715.3Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cac