CVE-2026-28352

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.

• CWE-306

• https://github.com/indico/indico/releases/tag/v3.3.11Product, Release Notes
• https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5vMitigation, Patch, Vendor Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28342OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-28343CKEditor 5 is a modern JavaScript rich-text editor with an M…6.1
• CVE-2026-28348lxml_html_clean is a project for HTML cleaning functionaliti…6.1
• CVE-2026-2835An HTTP Request Smuggling vulnerability (CWE-444) has been f…9.1
• CVE-2026-28350lxml_html_clean is a project for HTML cleaning functionaliti…6.1
• CVE-2026-28351pypdf is a free and open-source pure-python PDF library. Pri…5.3
• CVE-2026-28353Trivy Vulnerability Scanner is a VS Code extension that help…10
• CVE-2026-28354ClipBucket v5 is an open source video sharing platform. Prio…6.5
• CVE-2026-28355Canarytokens help track activity and actions on a network. V…1.3
• CVE-2026-28356multipart is a fast multipart/form-data parser for python. P…7.5
• CVE-2026-28357NocoDB is software for building databases as spreadsheets. P…5.4
• CVE-2026-28358NocoDB is software for building databases as spreadsheets. P…5.3