indico vulnerabilities
CVEs whose affected-version data names the indico package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
13 CVEsRSS
CVE-2026-108388Low· 3.5Indico is a feature-rich event management system
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management per…
CVE-2026-107397Medium· 4.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event mi…
CVE-2026-107396Medium· 5.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafte…
CVE-2026-107395Medium· 4.3Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session…
CVE-2026-107394Medium· 6.8Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a cra…
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
CVE-2026-28352Medium· 6.5Indico has a missing access check in the event series management API
Indico has a missing access check in the event series management API
CVE-2026-25739Medium· 5.4Indico Affected by Cross-Site-Scripting via material uploads
Indico Affected by Cross-Site-Scripting via material uploads
CVE-2026-25738MediumIndico has Server-Side Request Forgery (SSRF) in multiple places
Indico has Server-Side Request Forgery (SSRF) in multiple places
CVE-2025-59035Medium· 4.6Indico vulnerable to Cross-Site Scripting via LaTeX math code
Indico vulnerable to Cross-Site Scripting via LaTeX math code
CVE-2025-59034Medium· 4.3Indico may disclose unauthorized user details access via legacy API
Indico may disclose unauthorized user details access via legacy API
CVE-2025-53640MediumPoCIndico vulnerability allows attackers to bulk dump user details
Indico vulnerability allows attackers to bulk dump user details
CVE-2024-50633None· 0.0PoCIndico Insecure Access
Indico Insecure Access