CVE-2026-107395

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.

• CWE-862

• https://github.com/indico/indico/commit/524e8e93eadcd8484905b1147020a35f5dce6038
• https://github.com/indico/indico/releases/tag/v3.3.13
• https://github.com/indico/indico/security/advisories/GHSA-6p4f-j8j6-463q

Published

Oct 8, 2026

Last Modified

Oct 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10739Cato Networks SDP Client for Windows before 6.12.6 allows a …8.5
• CVE-2026-107390music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107391music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107392music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107393FreeScout is a self-hosted help desk and shared mailbox. Pri…6.1
• CVE-2026-107394Indico is an event management system that uses Flask-Multipa…6.8
• CVE-2026-107396Indico is an event management system that uses Flask-Multipa…5.4
• CVE-2026-107397Indico is an event management system that uses Flask-Multipa…4.4
• CVE-2026-107399The Mechanize library is used for automating interaction wit…6.8
• CVE-2026-1074The WP App Bar plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-10740Unbounded memory allocation in the CRYPTO frame reassembler …6.9
• CVE-2026-107406Memory overflow vulnerability leading to Remote Code Executi…9.5