CVE-2026-107396 Details
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
A cross-site scripting (XSS) vulnerability has been identified in Indico, an event management system, in versions prior to 3.3.13. The issue arises in fields that allow users to enter custom URLs, such as those for event management or content creation. Users can inject malicious JavaScript into these fields, which is executed in the context of the user's browser when the URL is followed. This vulnerability requires at least 'submitter' or management access in an event, and an interaction from the victim, such as clicking the link.
Users are advised to update Indico to version 3.3.13 or later. Instructions for updating can be found in the Indico documentation. Additionally, it is recommended to enable Content Security Policy (CSP) and to restrict event management and content creation privileges to trustworthy users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18 | [email protected] | Source CodeVendor |
| https://github.com/indico/indico/pull/7619 | [email protected] | Source CodeVendor |
| https://github.com/indico/indico/releases/tag/v3.3.13 | [email protected] | Release NotesVendor |
| https://github.com/indico/indico/security/advisories/GHSA-c4wc-ggrj-jg9v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-692 | Incomplete Denylist to Cross-Site Scripting | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Indico | < 3.3.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |