CVE-2026-107395
MediumCVSS 4.3Summary
In Indico prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners.
Risk Assessment
This may lead to unauthorized disclosure of information about restricted event sessions, breaching the confidentiality of organizational data.
Recommendation
Update Indico to version 3.3.13 or later, which fixes the missing access check.
Other vulnerabilities in Indico
See all- CVE-2026-107397Medium
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
- CVE-2026-107396Medium
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
- CVE-2026-107394Medium
In Indico prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features.
- CVE-2023-37901Medium
Indico, a web-based event management tool, has a Cross-Site Scripting vulnerability in confirmation prompts used for deleting content. Exploitation requires someone with submission privileges to attempt to delete content, creating an attack risk.
Original NVD description (English source)
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS