Cross-Site Scripting Vulnerability in Indico Event Management System
CVE-2026-107396

5.4MEDIUM

Key Information:

Vendor

Indico

Status
Indico
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107396?

Indico, an event management system utilizing Flask-Multipass for multi-backend authentication, is susceptible to a Cross-Site Scripting vulnerability. Users authorized to manage events or create content can inject malicious JavaScript URLs into input fields. When other users click these crafted URLs, it leads to the execution of attacker-controlled scripts in their browsers, compromising the security and integrity of user sessions. This vulnerability has been addressed in version 3.3.13.

Affected Version(s)

indico < 3.3.13

References

https://github.com/indico/indico/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/indico/indico/pull/7619
x_refsource_MISC
https://github.com/indico/indico/commit/d4c8c7127176efa4c...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.