CVE-2026-107396 in Indico
Summary
by MITRE • 10/08/2026
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
Indico serves as a comprehensive event management platform widely utilized by academic and professional organizations to coordinate conferences, workshops, and seminars. The system relies on Flask-Multipass for its authentication infrastructure, which supports multiple backend identity providers to handle user logins securely. However, prior to version 3.3.13, the application contained a critical input validation flaw within fields designed to accept custom URLs. This vulnerability allows users with permissions to manage events or create content, including speakers who have the ability to upload materials and define metadata for those items, to inject malicious payloads into these URL fields. The core technical issue stems from insufficient sanitization of user-supplied data when it is rendered in web pages without proper encoding or context-aware escaping mechanisms.
The specific nature of this flaw constitutes a Stored Cross-Site Scripting vulnerability, categorized under CWE-79 in the Common Weakness Enumeration standard. By storing crafted JavaScript URLs within event metadata or speaker submission fields, an attacker can persist malicious code on the server side rather than relying solely on transient input during a session. When another user views the affected content, such as reviewing a conference schedule or accessing uploaded materials, their browser retrieves and executes the embedded script within the context of the Indico origin. This execution environment grants the attacker-controlled script access to cookies, session tokens, and other sensitive data protected by same-origin policies, effectively bypassing standard security boundaries that typically restrict cross-domain interactions.
The operational impact of this vulnerability is significant for organizations relying on Indico for secure event coordination. An exploited instance allows an authenticated user with modest privileges, such as a speaker or content creator, to perform actions on behalf of other users without their knowledge or consent. This can lead to account takeover through session hijacking, where the attacker captures valid authentication tokens to impersonate administrators or high-privilege users. Furthermore, it enables phishing attacks within the trusted domain, potentially tricking users into revealing credentials for external systems linked via single sign-on configurations. The persistence of the payload means that every user viewing the compromised content is at risk until the malicious data is manually removed from the database by an administrator.
To mitigate this vulnerability and prevent similar issues in future deployments, it is essential to implement robust input validation and output encoding strategies consistent with OWASP guidelines for preventing cross-site scripting attacks. Developers should ensure that all user-supplied URL fields are strictly validated against a whitelist of allowed protocols and domains before storage. Additionally, when rendering these values in HTML contexts, they must be properly encoded using context-specific escaping techniques to prevent the browser from interpreting them as executable code. Organizations running affected versions of Indico prior to 3.3.13 should immediately upgrade to version 3.3.13 or later where this issue has been resolved. Security teams should also audit existing event data for any signs of exploitation and review access controls to ensure that only trusted individuals can modify critical metadata fields. This incident highlights the importance of treating all user input as untrusted, regardless of the perceived privilege level of the submitting account, aligning with defense-in-depth principles recommended by industry standards such as MITRE ATT&CK technique T1059 for command and script interpretation within web applications.