CVE-2026-28352: Indico Event Series Management API Lacks Access Control
Summary
CVE-2026-28352: Indico has a missing access check in the event series management API. Affects indico versions < 3.3.11. Fixed in 3.3.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that facilitates the organization of conferences, workshops, and other events. It provides features for managing event schedules, registrations, and participant interactions. However, a recent vulnerability has been identified in its event series management API, which could expose sensitive metadata to unauthorized users.
Vulnerability Detail
The vulnerability arises from a missing access check in the event series management API of Indico. This flaw allows unauthenticated or unauthorized users to access the API endpoint, leading to potential exposure of event series metadata, including titles, categories, and dates. While the vulnerability does not permit access to detailed event data or tampering with user-visible information, it does allow for the deletion and modification of event series metadata, which could disrupt event organization.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.11
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, developers can configure their web server to restrict access to the series management API endpoint. This can be done by adding access control rules in the server configuration to limit access to authorized users only.
Conclusion
The CVE-2026-28352 vulnerability in Indico poses a risk by allowing unauthorized access to event series management API. It is crucial for users to update to version 3.3.11 or later to mitigate this risk. Additionally, implementing access control measures can provide temporary protection until the update is applied.
See every vulnerability recorded for indico →
FAQ
CVE-2026-28352 is a vulnerability in the Indico event management software that allows unauthorized access to the event series management API due to a missing access check.
The vulnerability allows unauthorized users to view event series metadata, delete event series, and modify metadata display settings, potentially disrupting event organization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
You can restrict access to the series management API endpoint by configuring your web server to allow only authorized users to access it.
Related vulnerabilities
Recent vulnerabilities recorded for indico.
