CVE-2026-107398 Indico: Local file disclosure through offline-copy path traversal

Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the serve...

CVE-2026-107398

The Indico event management system is vulnerable to a path traversal vulnerability in versions prior to 3.3.14 . When building an "offline copy" of an event, a malicious event manager can exploit this flaw to retrieve the content of any local file readable by the user running the Indico service o...

CVE-2025-53640

CVE-2025-53640 – Authenticated User Enumeration in CERN's Indico BOLA Vulnerability PoC and technical analysis of CVE-2025-53640: a Broken Object Level Authorization BOLA vulnerability in Indico enables authenticated user enumeration via endpoint, exposing names, emails, and affiliations. Include...

CVE-2024-50633

CVE-2024-50633 🏆 - CVE-2024-50633 : Indico BOLA Vulnerability Discovered and reported a BOLA vulnerability in Indico. 📜 Description CVE-2024-50633 A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive user information by manipulating API...

Indico: Incomplete Server-Side Request Forgery (SSRF) check

ImpactIndico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints. The previous fix CVE-2026-25738 did no...

PYSEC-2026-4225 Indico: Incomplete Server-Side Request Forgery (SSRF) check

Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints. The previous fix CVE-2026-25738 did n...

Indico: Missing access check in legacy session export API

ImpactA legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. PatchesYou should to update to Indico 3.3.13 as soon as...

PYSEC-2026-4226 Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

PYSEC-2026-4227 Indico: Cross-Site-Scripting in link fields

Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of...

PYSEC-2026-4228 Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

Indico: Cross-Site-Scripting in link fields

ImpactThere is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. PatchesYou should to update to Indico 3.3.13 as soon as possible.See the docs for instructions on how to update. Workarounds- Set CSPENABLED = True in indico.conf - this is recommended regardless of...

Indico: Cross-Site-Scripting in minutes editor

ImpactThere is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. PatchesYou should to update to Indico 3.3.13 as soon as possible.See the docs for instructions on how to update. Workarounds- Set...

CVE-2026-108388

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-108388

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-108388 Indico legacy contribution export cache poisoning discloses restricted metadata

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

EUVD-2026-100675

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-108388

The event management system Indico versions 3.3.3 through 3.3.13 is vulnerable to a cache poisoning issue. The software incorrectly utilizes the ambient web-session user instead of the specific user provided to Contribution.can_manage when verifying inherited event contribution-management permiss...

CVE-2026-108388 Indico legacy contribution export cache poisoning discloses restricted metadata

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-108388 Indico legacy contribution export cache poisoning discloses restricted metadata

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-108388: Incorrect Authorization

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...