Flask-Multipass Vulnerability in Indico Event Management System
CVE-2026-107394

6.8MEDIUM

Key Information:

Vendor

Indico

Status
Indico
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107394?

Indico, an event management system leveraging Flask-Multipass for authentication, is susceptible to a vulnerability that allows an event organizer to exploit crafted URLs. Before version 3.3.13, the system did not adequately handle specific edge cases from a prior fix, enabling unauthorized access to sensitive data from restricted local targets. This vulnerability is addressed in Indico version 3.3.13.

Affected Version(s)

indico < 3.3.13

References

https://github.com/indico/indico/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/indico/indico/pull/7573
x_refsource_MISC
https://github.com/indico/indico/commit/44540e70ab4e20a12...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.