CVE-2026-107397 Details
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
A cross-site scripting (XSS) vulnerability has been identified in Indico, an event management system, in versions prior to 3.3.13. The issue arises in the minutes editor conflict user interface when concurrent edits are made to the same minutes. Users with content creation privileges, including speakers who can edit minutes, are able to inject malicious HTML that is executed in the browser of the viewer, within the Indico origin. This vulnerability is particularly concerning because it allows for the execution of attacker-controlled scripts, potentially leading to harmful consequences.
Users are advised to update Indico to version 3.3.13, where this vulnerability has been fixed. Instructions for updating can be found in the Indico documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18 | [email protected] | Source CodeVendor |
| https://github.com/indico/indico/pull/7619 | [email protected] | Source CodeVendor |
| https://github.com/indico/indico/releases/tag/v3.3.13 | [email protected] | Release NotesVendor |
| https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Indico | < 3.3.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |