CVE-2026-107395: Indico Package Vulnerability - Missing Access Check in Legacy Session Export API
Summary
CVE-2026-107395: Indico: Missing access check in legacy session export API. Affects indico versions < 3.3.13. Fixed in 3.3.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that allows users to organize conferences, workshops, and other events. It provides features for managing sessions, registrations, and participant interactions. However, a vulnerability has been identified in its legacy session export API, which could allow unauthorized access to sensitive session metadata.
Vulnerability Detail
The vulnerability arises from a missing access check in the legacy API used to retrieve session details. This flaw allows users to access metadata such as the title, description, and conveners of restricted sessions, provided they have access to the event itself. This could lead to unauthorized exposure of sensitive information, potentially compromising the privacy of session organizers and participants.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.13
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the event itself to prevent unauthorized users from accessing the session metadata.
Conclusion
The Indico package has a vulnerability (CVE-2026-107395) that allows unauthorized access to session metadata due to a missing access check in its legacy API. It is crucial to update to version 3.3.13 or later to mitigate this risk. In the meantime, restricting access to events can serve as a temporary workaround.
See every vulnerability recorded for indico →
FAQ
CVE-2026-107395 is a vulnerability in the Indico package that allows unauthorized access to session metadata through a legacy API.
The risks include unauthorized exposure of sensitive session details, which could compromise the privacy of event organizers and participants.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updating is not possible, restrict access to the event to mitigate the risk of unauthorized access to session metadata.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for indico.
