CVE-2026-107395— Indico: Missing access check in legacy session export API
Quick assessment
Affected
indico indico
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Indico 是一个活动管理系统，使用 Flask-Multipass 作为支持多后端认证的 Flask 插件。在版本 3.3.13 之前，经过身份验证的用户可以滥用旧的会话导出 API，在无需实际访问受限会话的情况下，获取该会话的详细信息，只要该会话所属的活动是可访问的。由于缺少访问检查，攻击者可以泄露会话的元数据，例如标题、描述和组织者信息。该问题已在版本 3.3.13 中修复。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107395
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Indico: Missing access check in legacy session export API
Source: CVE Program / CVE List V5
Vulnerability Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107395
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107395
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-107395 (1)
Vendor Advisories for CVE-2026-107395 (1)
Vendor Pages for CVE-2026-107395 (1)
-
🔗 Release v3.3.13 · indico/indico · GitHub x_refsource_MISC
Same Patch Batch · indico · 2026-10-08 · 4 CVEs total
| CVE-2026-107394 | 6.8 MEDIUM | Indico: Incomplete Server-Side Request Forgery (SSRF) check |
| CVE-2026-107396 | 5.4 MEDIUM | Indico: Cross-Site-Scripting in link fields |
| CVE-2026-107397 | 4.4 MEDIUM | Indico: Cross-Site-Scripting in minutes editor |
IV. Related Vulnerabilities
Same product: indico
-
CVE-2026-107397
Indico: Cross-Site-Scripting in minutes editor -
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields -
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check -
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execut -
CVE-2026-28352
Indico missing access check in event series management API
Same vendor: indico
-
CVE-2026-107397
Indico: Cross-Site-Scripting in minutes editor -
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields -
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check -
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execut -
CVE-2026-28352
Indico missing access check in event series management API
Same weakness: CWE-862
-
CVE-2026-62028
WordPress Before After Image Comparison – Image comparison f -
CVE-2026-105883
WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Contr -
CVE-2026-104079
Envira Gallery Lite < 1.16.2 Missing Authorization via Galle -
CVE-2026-39779
WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Cont -
CVE-2026-62040
WordPress Restrict User Access – Membership plugin with Forc
V. Comments for CVE-2026-107395
No comments yet