Authentication Bypass Vulnerability in Indico Event Management System

CVE-2026-33046

What is CVE-2026-33046?

Indico, an event management platform using Flask-Multipass for authentication, is affected by a LaTeX injection vulnerability in versions before 3.3.12. This issue arises from flaws in TeXLive and peculiar LaTeX syntax, allowing attackers to bypass the LaTeX sanitizer within Indico. Exploitation of this vulnerability could enable unauthorized reading of local files or executing code with the permissions of the Indico process on the server. To mitigate the risk, it is crucial to update to Indico version 3.3.12, or alternatively configure the LaTeX functionality by disabling server-side rendering. Isolating the LaTeX renderer with containerization is also highly recommended to enhance security.

References