CVE-2026-107394
Last modified
CVE-2026-107394 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico.
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| indico | indico | < 3.3.13 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-107394?
How severe is CVE-2026-107394?
How do I fix CVE-2026-107394?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107389music-metadata is a metadata parser for audio and video medi…6.2
- CVE-2026-10739Cato Networks SDP Client for Windows before 6.12.6 allows a …8.5
- CVE-2026-107390music-metadata is a metadata parser for audio and video medi…6.2
- CVE-2026-107391music-metadata is a metadata parser for audio and video medi…6.2
- CVE-2026-107392music-metadata is a metadata parser for audio and video medi…6.2
- CVE-2026-107393FreeScout is a self-hosted help desk and shared mailbox. Pri…6.1
- CVE-2026-107395Indico is an event management system that uses Flask-Multipa…4.3
- CVE-2026-107396Indico is an event management system that uses Flask-Multipa…5.4
- CVE-2026-1074The WP App Bar plugin for WordPress is vulnerable to Stored …7.2
- CVE-2026-10740Unbounded memory allocation in the CRYPTO frame reassembler …6.9
- CVE-2026-10741Sonatype Nexus Repository Manager before 3.93.0 contains an …4.9
- CVE-2026-10744IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an…7.5
Are you affected by CVE-2026-107394?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST