Medium severity · published Oct 8, 2026
CVE-2026-107395
Indico: Missing access check in legacy session export API
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
indico · indico
< 3.3.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107395
x_refsource_CONFIRM
https://github.com/indico/indico/security/advisories/GHSA-6p4f-j8j6-463q
x_refsource_MISC
https://github.com/indico/indico/commit/524e8e93eadcd8484905b1147020a35f5dce6038
x_refsource_MISC
https://github.com/indico/indico/releases/tag/v3.3.13
More from indico
8.8
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
6.8
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check
6.5
CVE-2026-28352
Indico missing access check in event series management API
6.5
CVE-2025-53640
Indico vulnerable to user enumeration via API endpoint
6.1
CVE-2024-45399
Indico has a Cross-Site-Scripting during account creation