CVE-2026-107395Medium· 4.3▾ SunlitIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
indico < 3.3.13Patched in:
indico 3.3.13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107397Medium· 4.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
CVE-2026-107394Medium· 6.8Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
CVE-2026-107396Medium· 5.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection
CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API
CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads