CVE-2026-108388: Indico legacy contribution export cache poisoning discloses restricted metadata
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Indicoto a version that resolves this vulnerability.Fixed in 3.3.14
Event History
Frequently Asked Questions
Which deployments are affected?
Indico versions 3.3.3 through 3.3.13 are affected. The issue is fixed in Indico 3.3.14.
What must an attacker do to exploit this issue?
The attacker needs a low-privileged account and must induce a privileged user to request a crafted legacy contribution export. The resulting cached API entry can then be retrieved with less privilege.
What information could be exposed?
The poisoned cache entry may disclose speaker or author email addresses and contribution access-control entries.