User Data Exposure Vulnerability in Indico Event Management System
CVE-2025-53640

5.3MEDIUM

Key Information:

Vendor

Indico

Status
Indico
Vendor
CVE Published:
14 July 2025

What is CVE-2025-53640?

The Indico event management system, utilizing Flask-Multipass for authentication, presents a vulnerability where endpoints could be exploited to reveal sensitive user information, including names, affiliations, and email addresses. This issue affects versions 2.2 through 3.3.6 and poses a risk for installations that permit public user account creation. While upgrading to version 3.3.7 is highly recommended to remediate this issue, administrators can also limit user searches to manager accounts as a temporary measure. However, restricting endpoint access may hinder functionality related to user details in certain forms.

Affected Version(s)

indico >= 2.2, < 3.3.7

References

https://github.com/indico/indico/security/advisories/GHSA...
x_refsource_CONFIRM
https://docs.getindico.io/en/stable/config/settings/#ALLO...
x_refsource_MISC
https://docs.getindico.io/en/stable/installation/upgrade
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53640 : User Data Exposure Vulnerability in Indico Event Management System