CVE-2026-107396

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.

• CWE-692

• https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
• https://github.com/indico/indico/pull/7619
• https://github.com/indico/indico/releases/tag/v3.3.13
• https://github.com/indico/indico/security/advisories/GHSA-c4wc-ggrj-jg9v

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107390music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107391music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107392music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107393FreeScout is a self-hosted help desk and shared mailbox. Pri…6.1
• CVE-2026-107394Indico is an event management system that uses Flask-Multipa…6.8
• CVE-2026-107395Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-1074The WP App Bar plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-10740Unbounded memory allocation in the CRYPTO frame reassembler …6.9
• CVE-2026-10741Sonatype Nexus Repository Manager before 3.93.0 contains an …4.9
• CVE-2026-10744IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an…7.5
• CVE-2026-107444A flaw was found in Katello where the Docker Tags repositori…4.3
• CVE-2026-107445A flaw was found in Katello where the Flatpak Remote Reposit…5.4