CVE-2026-107395 in Indico
Summary
by MITRE • 10/08/2026
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
Indico serves as a comprehensive open-source event management platform widely utilized by academic institutions and research organizations to organize conferences, seminars, and workshops. The system relies on Flask-Multipass for its authentication architecture, which supports multiple backend identity providers to manage user access across various services. A critical security flaw was identified in versions of Indico prior to 3.3.13 involving the legacy session export API endpoint. This vulnerability stems from an insufficient authorization check within the application logic that governs how users interact with event sessions. Specifically, the system failed to verify whether a requesting user possessed explicit permissions for individual sessions before allowing data retrieval through this specific interface.
The technical nature of this flaw constitutes an Insecure Direct Object Reference (IDOR) vulnerability, categorized under CWE-639 in standard security taxonomies. The attack vector allows any authenticated user who has access to the parent event container to exploit the session export functionality without needing direct membership or permission for the specific restricted sessions within that event. By manipulating parameters sent to the legacy API endpoint, an attacker can bypass intended access controls and retrieve sensitive metadata associated with private or confidential sessions. This includes details such as session titles, descriptions, abstracts, and information about conveners or speakers who may have opted out of public visibility for privacy reasons.
The operational impact of this vulnerability is significant in contexts where confidentiality is paramount, such as peer-reviewed academic conferences or internal corporate strategy meetings. The disclosure of restricted session metadata can lead to the exposure of unpublished research findings, sensitive business strategies, or personal information about speakers and organizers who expected their participation details to remain private. This breach of data integrity undermines trust in the platform’s ability to enforce granular access controls and may result in reputational damage for event organizers as well as potential privacy violations under regulations such as GDPR if personal data is exposed without consent.
This vulnerability aligns with MITRE ATT&CK technique T1078, which covers Valid Accounts used by adversaries to maintain persistence or escalate privileges within a system. Although the attacker does not gain full administrative control, they effectively bypass access controls to gather intelligence that could facilitate further attacks or social engineering efforts against targeted individuals listed in the session metadata. The exploitation requires only valid authentication credentials and basic interaction with the web interface, making it relatively straightforward for any malicious actor who has obtained legitimate user accounts within an accessible event space.
The issue was addressed in Indico version 3.3.13 by implementing rigorous access control checks at the API level to ensure that users can only retrieve session data if they have explicit permission to view that specific session, regardless of their broader access to the containing event. Organizations running older versions must upgrade immediately to mitigate this risk. In addition to upgrading, administrators should review audit logs for any suspicious activity related to the legacy export endpoint and consider disabling or restricting access to deprecated APIs until all systems are updated. Regular security assessments and penetration testing focused on authorization logic are recommended to detect similar flaws in complex multi-backend authentication environments where granular permissions are critical.