Disclosure summary
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
Source-reported weakness categories
CWE-862
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-107395
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-6p4f-j8j6-463q
Open original source · Updated Oct 08, 2026
Indico: Missing access check in legacy session export API
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | indico | < 3.3.13 | 3.3.13 |
Original records & references
PUBLISHED 2026-10-08T16:17:34-04:00
MODIFIED 2026-10-09T08:17:08-04:00
INGESTED 2026-10-10T20:55:03-04:00