Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108388— Indico legacy contribution export cache poisoning discloses restricted metadata

Quick assessment

Affected
indico indico
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Indico 是一款功能丰富的活动管理系统。在 Indico 3.3.3 至 3.3.13 版本中，系统在检查继承的活动贡献管理权限时，错误地使用了当前 Web 会话中的用户，而不是传递给 方法的用户。低权限用户可以诱导高权限用户请求一个精心构造的旧版贡献导出操作，从而导致演讲者或作者的电子邮件地址以及贡献访问控制条目被存储在一个 API 缓存条目中。该缓存条目可以使用较低权限进行访问。此问题已在 Indico 3.3.14 版本中修复。

CVSS 3.5 · Low EPSS 0.26% · P16

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
indico indico >= 3.3.3, < 3.3.14 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108388

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Indico legacy contribution export cache poisoning discloses restricted metadata
Source: CVE Program / CVE List V5
Vulnerability Description
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
indico indico >= 3.3.3, < 3.3.14 -

II. Public POCs for CVE-2026-108388

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108388

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108388 (2)

Vendor Advisories for CVE-2026-108388 (1)

Vendor Pages for CVE-2026-108388 (1)

IV. Related Vulnerabilities

Same product: indico
Same vendor: indico
Same weakness: CWE-863

V. Comments for CVE-2026-108388

No comments yet

Leave a comment