CVE-2026-107395: Indico: Missing access check in legacy session export API
Impact A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible.
Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update.
Workarounds Restrict access to the event itself
For more information If you have any questions or comments about this advisory:
- Open a thread in our forum - Email us privately at indico-team@cern.ch
Other sources
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/indicoto a version that resolves this vulnerability.Fixed in 3.3.13 - Upgrade
Upgrade
Indicoto a version that resolves this vulnerability.Fixed in 3.3.13 - Compensating control
Restrict access to the event itself.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Indico user can exploit it if they can access the event containing a restricted session. They do not need access to the restricted session itself.
What information could be exposed?
The legacy session export API can disclose metadata for restricted sessions, including the session title, description, and conveners. The provided information does not indicate exposure of session content or modification capabilities.
Which deployments are affected?
Indico versions prior to 3.3.13 are affected. The issue concerns deployments where authenticated users can access an event that contains restricted sessions.
How can this be remediated?
Upgrade Indico to version 3.3.13, which includes the fix for the missing access check in the legacy session export API.