Indico: Missing access check in legacy session export API

ImpactA legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. PatchesYou should to update to Indico 3.3.13 as soon as...

GHSA-6P4F-J8J6-463Q Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

CVE-2026-107395

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

CVE-2026-107395 Indico: Missing access check in legacy session export API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

CVE-2026-107395

The event management system Indico is vulnerable to a missing access check in its legacy session export API, used by the Flask-Multipass authentication system. Versions prior to 3.3.13 allow an authenticated user to retrieve details for a restricted session—such as the title, description, and con...

CVE-2026-107395 Indico: Missing access check in legacy session export API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...