CVE-2026-108388

The event management system Indico versions 3.3.3 through 3.3.13 is vulnerable to a cache poisoning issue. The software incorrectly utilizes the ambient web-session user instead of the specific user provided to Contribution.can_manage when verifying inherited event contribution-management permiss...