CVE-2024-50633

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

Indico 安全漏洞

Indico is a feature-rich event management system from Indico Open Source. A security vulnerability exists in Indico version v3.2.9, which stems from a corrupted object-level authorization issue that allows an attacker to access sensitive information by sending a crafted POST request to the...

PT-2025-2876 · Indico · Indico

Name of the Vulnerable Software and Affected Versions: Indico versions 3.2.9 through 3.3.5 Description: A Broken Object Level Authorization BOLA issue allows attackers to read or access sensitive information by sending a crafted POST request to the "/api/principals" component. The supplier disput...