Disclosure summary
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
Source-reported weakness categories
CWE-918
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-107394
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-2v95-h47v-g4x9
Open original source · Updated Oct 08, 2026
Indico: Incomplete Server-Side Request Forgery (SSRF) check
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | indico | < 3.3.13 | 3.3.13 |
Original records & references
PUBLISHED 2026-10-08T16:17:34-04:00
MODIFIED 2026-10-09T12:17:22-04:00
INGESTED 2026-10-10T20:55:03-04:00