CVE-2025-59034— Indico may disclose unauthorized user details access via legacy API
Quick assessment
Affected
indico indico
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Indico是Indico开源的一个功能丰富的事件管理系统。 Indico 3.3.8之前版本存在安全漏洞，该漏洞源于访问检查不当，可能导致未经授权检索其他用户的个人资料。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-59034
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Indico may disclose unauthorized user details access via legacy API
Source: CVE Program / CVE List V5
Vulnerability Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Indico 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Indico是Indico开源的一个功能丰富的事件管理系统。 Indico 3.3.8之前版本存在安全漏洞，该漏洞源于访问检查不当，可能导致未经授权检索其他用户的个人资料。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-59034
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-59034
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: indico
-
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execut -
CVE-2026-28352
Indico missing access check in event series management API -
CVE-2026-25739
Indico affected by Cross-Site-Scripting via material uploads -
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple pl -
CVE-2025-59035
Indico vulnerable to Cross-Site Scripting via LaTeX math cod
Same vendor: indico
-
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execut -
CVE-2026-28352
Indico missing access check in event series management API -
CVE-2026-25739
Indico affected by Cross-Site-Scripting via material uploads -
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple pl -
CVE-2025-59035
Indico vulnerable to Cross-Site Scripting via LaTeX math cod
Same weakness: CWE-639
-
CVE-2026-55867
Graylog token revocation endpoint allows authenticated users -
CVE-2026-19294
Langflow is affected by multiple authentication bypass, path -
CVE-2026-18904
Langflow is affected by multiple authentication bypass, path -
CVE-2026-55067
Vikunja: Authenticated cross-tenant kanban-bucket relocation -
CVE-2026-55066
Vikunja: Cross-tenant IDOR in kanban move-task endpoint via
V. Comments for CVE-2025-59034
No comments yet