CVE-2025-53640: Indico Package Vulnerability Allows Bulk Dump of User Details
Summary
CVE-2025-53640: Indico vulnerability allows attackers to bulk dump user details. Affects indico versions >= 2.2, < 3.3.7. Fixed in 3.3.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that facilitates the organization of conferences, workshops, and other events. It provides features such as user management, access control lists (ACLs), and event scheduling. However, a vulnerability has been identified that allows unauthorized access to basic user details, potentially compromising user privacy.
Vulnerability Detail
The vulnerability arises from an endpoint that displays user details in certain fields, such as ACLs. This endpoint can be exploited to dump sensitive user information, including names, affiliations, and email addresses, in bulk. If an instance allows public user account creation, this vulnerability poses a significant risk to user privacy and data security.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.7
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While it is possible to restrict access to the affected endpoints through web server configuration, this may disrupt certain functionalities. Therefore, upgrading to the patched version is highly recommended. If you still wish to implement a temporary restriction, you can modify your web server settings to limit access to the endpoint.
Conclusion
In summary, CVE-2025-53640 is a moderate severity vulnerability in the Indico package that allows unauthorized access to user details. It is crucial to update to version 3.3.7 to mitigate this risk. Temporary workarounds may be implemented, but upgrading is the recommended solution.
See every vulnerability recorded for indico →
FAQ
CVE-2025-53640 is a vulnerability in the Indico package that allows unauthorized users to bulk dump sensitive user details.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without needing to sign up.
If immediate upgrading is not possible, consider restricting access to the affected endpoints in your web server configuration as a temporary measure.
The vulnerability can leak basic user details such as names, affiliations, and email addresses.
For more information, you can refer to the advisory on GitHub or contact the Indico team via their forum or email.
References
Related vulnerabilities
Recent vulnerabilities recorded for indico.
