Medium severity · published Oct 8, 2026
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
indico · indico
< 3.3.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107394
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107394
x_refsource_CONFIRM
https://github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9
x_refsource_MISC
https://github.com/indico/indico/pull/7573
x_refsource_MISC
https://github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736
x_refsource_MISC
https://github.com/indico/indico/releases/tag/v3.3.13
More from indico
8.8
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
6.5
CVE-2026-28352
Indico missing access check in event series management API
6.5
CVE-2025-53640
Indico vulnerable to user enumeration via API endpoint
6.1
CVE-2024-45399
Indico has a Cross-Site-Scripting during account creation
5.4
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields