CVE-2025-53640

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.

• CWE-200
• CWE-639
• CWE-862
• CWE-639

• https://docs.getindico.io/en/stable/config/settings/#ALLOW_PUBLIC_USER_SEARCHProduct
• https://docs.getindico.io/en/stable/installation/upgradeProduct
• https://github.com/indico/indico/releases/tag/v3.3.7Release Notes
• https://github.com/indico/indico/security/advisories/GHSA-q28v-664f-q6wjVendor Advisory
• https://www.vicarius.io/vsociety/posts/cve202553640-detect-indico-vulnerabilityExploit, Third Party Advisory
• https://www.vicarius.io/vsociety/posts/cve202553640-mitigate-indico-vulnerabilityExploit, Mitigation, Third Party Advisory

Published

Jul 14, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53634Chall-Manager is a platform-agnostic system able to start Ch…7.5
• CVE-2025-53636Open OnDemand is an open-source HPC portal. Users can flood …5.4
• CVE-2025-53637Meshtastic is an open source mesh networking solution. The m…8
• CVE-2025-53638Solady is software that provides Solidity snippets with APIs…6.9
• CVE-2025-53639MeterSphere is an open source continuous testing platform. P…9.8
• CVE-2025-5364A vulnerability was found in Campcodes Online Hospital Manag…9.8
• CVE-2025-53641Postiz is an AI social media scheduling tool. From 1.45.1 to…8.2
• CVE-2025-53642haxcms-nodejs and haxcms-php are backends for HAXcms. The lo…6.5
• CVE-2025-53643AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2025-53644OpenCV is an Open Source Computer Vision Library. Versions 4…9.8
• CVE-2025-53645Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x bef…7.5
• CVE-2025-53648SQL misconfiguration in the Gravitino UI, in versions 1.0.0 …5.4