CVE-2026-107397

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.

• CWE-79

• https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
• https://github.com/indico/indico/pull/7619
• https://github.com/indico/indico/releases/tag/v3.3.13
• https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107391music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107392music-metadata is a metadata parser for audio and video medi…6.2
• CVE-2026-107393FreeScout is a self-hosted help desk and shared mailbox. Pri…6.1
• CVE-2026-107394Indico is an event management system that uses Flask-Multipa…6.8
• CVE-2026-107395Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-107396Indico is an event management system that uses Flask-Multipa…5.4
• CVE-2026-107399The Mechanize library is used for automating interaction wit…6.8
• CVE-2026-1074The WP App Bar plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-10740Unbounded memory allocation in the CRYPTO frame reassembler …6.9
• CVE-2026-107406Memory overflow vulnerability leading to Remote Code Executi…9.5
• CVE-2026-10741Sonatype Nexus Repository Manager before 3.93.0 contains an …4.9
• CVE-2026-10744IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an…7.5