CVE-2026-108388 in Indico
Summary
by MITRE • 10/14/2026
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Indico is a widely deployed open-source event management platform used by academic institutions, research organizations, and professional societies to organize conferences, seminars, and workshops. The software manages complex data structures including speaker profiles, author details, contribution metadata, and granular access control lists that dictate who can view or modify specific content within an event. In versions 3.3.3 through 3.3.13, a critical logic flaw exists in the permission checking mechanism for contributions, specifically affecting how inherited management permissions are evaluated during legacy export operations. This vulnerability stems from an incorrect implementation of role-based access control where the system fails to validate that the user initiating the action possesses the necessary privileges relative to the specific contribution being accessed, instead relying on ambient session context which may belong to a higher-privileged entity or fail to enforce strict isolation between users with different clearance levels.
The technical core of this vulnerability lies in the Contribution.can_manage method and its interaction with legacy export functionality. When a user requests an export of a contribution's data, the system is supposed to verify that the requesting user has management rights over that specific contribution based on inherited event-level permissions. However, due to the flaw, the check incorrectly utilizes the ambient web-session user context rather than strictly validating against the explicit user credentials supplied for the permission check. This discrepancy allows an attacker with low-privileged access to manipulate the request flow such that a privileged user's session or authentication context is inadvertently leveraged during the processing of the export request. By inducing a privileged user, perhaps through social engineering or cross-site scripting vectors if available in conjunction with this flaw, to trigger a crafted legacy contribution export, the attacker can bypass intended security boundaries.
The operational impact of this vulnerability centers on unauthorized data exposure and cache poisoning via API caching mechanisms. When the flawed permission check is exploited, sensitive personal information belonging to speakers and authors, specifically their email addresses, along with detailed access-control entries that define who has what permissions for each contribution, are generated as part of the export process. Instead of being discarded or properly secured after use, these data artifacts are stored in an API cache entry. Crucially, this cached data is retrievable by users with significantly lower privileges than those required to perform the initial action. This means that once a privileged user inadvertently triggers the flawed export, any subsequent low-privileged user can query the same API endpoint and retrieve the cached response containing the sensitive email addresses and access control lists without needing elevated permissions themselves.
This scenario represents a classic case of insecure direct object references combined with improper privilege checks, leading to information disclosure. From an industry standards perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, as the system fails to enforce proper authorization policies for API resources. Furthermore, it relates to CWE-613 Insufficient Session Expiration if the session context is misused, and more critically CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes regarding the caching behavior that retains sensitive data beyond its necessary lifecycle. In terms of MITRE ATT&CK mapping, this technique falls under T1078 Valid Accounts for initial access if social engineering is used to trigger the privileged action, and T1213 Data from Information Repositories for retrieving the cached data, specifically leveraging cache poisoning or side-channel effects inherent in improperly secured caching layers.
Mitigation strategies must prioritize immediate patching of the Indico installation to version 3.3.14 or later, where this logic error has been corrected by ensuring that permission checks strictly adhere to the explicit user context rather than ambient session states. For organizations unable to patch immediately due to operational constraints, network-level controls should be implemented to restrict access to the specific API endpoints involved in contribution exports to only those users with verified management privileges. Additionally, reviewing and hardening cache configurations is essential; caching mechanisms for sensitive data such as personal email addresses and security policies should either be disabled entirely or configured with strict TTLs and user-specific keying to prevent cross-user retrieval of cached responses. Regular audits of access control lists and permission inheritance models are also recommended to ensure that no other similar logic flaws exist in related modules, maintaining the integrity of the event management system's security posture against privilege escalation and data leakage attacks.