CVE-2026-107395: Indico Legacy Session Export API Access Control Vulnerability
Summary
CVE-2026-107395: Indico: Missing access check in legacy session export API. Affects indico versions < 3.3.13. Fixed in 3.3.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Indico is an open-source event management software that facilitates the organization of conferences, workshops, and other academic events. It provides features for managing sessions, registrations, and participant interactions. However, a vulnerability has been identified in its legacy session export API, which could allow unauthorized access to session metadata.
Vulnerability Detail
The vulnerability arises from a missing access check in the legacy API used to retrieve session details. This flaw allows users to access metadata, such as the title, description, and conveners of restricted sessions, provided they have access to the event itself. This could lead to unauthorized disclosure of sensitive information, potentially compromising the privacy of session organizers and participants.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.13
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the event itself to prevent unauthorized users from accessing the session metadata.
Conclusion
In summary, the Indico legacy session export API has a vulnerability that could allow unauthorized access to session metadata. It is crucial to update to version 3.3.13 to mitigate this risk. Additionally, restricting access to events can serve as a temporary workaround while the update is applied.
See every vulnerability recorded for indico →
FAQ
The vulnerability is a missing access check in the legacy session export API of Indico, allowing unauthorized access to session metadata.
Unauthorized users may gain access to sensitive information about restricted sessions, which could compromise the privacy of event organizers and participants.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
Yes, the patch is available in Indico version 3.3.13. It is recommended to update to this version as soon as possible.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for indico.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
