CVE-2025-59034: Indico Legacy API Vulnerability Allows Unauthorized User Detail Access
Summary
CVE-2025-59034: Indico may disclose unauthorized user details access via legacy API. Affects indico versions < 3.3.8. Fixed in 3.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Indico is an open-source event management software that facilitates the organization of conferences, workshops, and other events. It provides a comprehensive suite of tools for managing registrations, schedules, and user interactions. However, a vulnerability in its legacy API allows unauthorized access to user profile details, potentially compromising user privacy.
Vulnerability Detail
The vulnerability arises from a broken access check in a legacy API that retrieves user details. This flaw allows users without admin permissions to access profile information of other users, leading to potential privacy breaches. The issue is classified under CWE-639, indicating a failure to enforce proper access controls.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.8
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected API in your web server configuration. This API is likely unused and restricting access will not disrupt normal operations. An example configuration might look like this:
<Directory /path/to/indico/api>
Require all denied
</Directory>
Conclusion
The vulnerability CVE-2025-59034 in Indico poses a significant risk by allowing unauthorized access to user details through a legacy API. It is essential to update to version 3.3.8 to mitigate this risk. Additionally, implementing temporary workarounds can help secure your application until the update is completed.
See every vulnerability recorded for indico →
FAQ
CVE-2025-59034 is a vulnerability in Indico that allows unauthorized access to user profile details through a legacy API.
Any version of Indico up to and including 3.3.7 is affected. You can check your version by running 'indico --version' in your terminal.
The primary risk is unauthorized access to sensitive user information, which can lead to privacy violations and potential misuse of data.
Yes, the patch is available in Indico version 3.3.8. It is recommended to update as soon as possible.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected without signing up at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for indico.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
