CVE-2026-108388
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Indico versions 3.3.3 through 3.3.13 incorrectly use the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export, causing speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. The issue was fixed in Indico 3.3.14.
Risk Assessment
Speaker and author email addresses and contribution access-control information may be leaked, resulting in a confidentiality breach. The risk affects Indico instances running versions 3.3.3–3.3.13.
Recommendation
Update Indico to version 3.3.14 or later. Until patching, restrict access to contribution export functionality and monitor for unusual export requests.
Other vulnerabilities in Indico
See all- CVE-2026-107397Medium
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
- CVE-2026-107396Medium
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
- CVE-2026-107395Medium
In Indico prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners.
- CVE-2026-107394Medium
In Indico prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features.
- CVE-2023-37901Medium
Indico, a web-based event management tool, has a Cross-Site Scripting vulnerability in confirmation prompts used for deleting content. Exploitation requires someone with submission privileges to attempt to delete content, creating an attack risk.
Original NVD description (English source)
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS