Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-108388 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.7 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:3.5 LOWVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/indico/indico/commit/0e71da31fc21d0ed0ce687cce5b745ba2fad0b92	[email protected]	Source CodeVendor
https://github.com/indico/indico/commit/5985cfa65a3441b7d3ca4ef1a9dc177c82ea0f26	[email protected]	Source CodeVendor
https://github.com/indico/indico/releases/tag/v3.3.14	[email protected]	Release NotesVendor
https://github.com/indico/indico/security/advisories/GHSA-p9vj-86c7-h7q3	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	[email protected]

Affected Products

Product	Versions
Indico	>= 3.3.3 (semver)
CPE cpe:2.3:a:cern:indico:::::::: Remediation Upgrade: 3.3.14moderate efforthttps://github.com/indico/indico/releases/tag/v3.3.14 Workaround:low effort Disable the HTTP API cache by setting the TTL to 0 on /admin/api/. Mitigation:low effort Block access to paths below /export/ that contain the ca=yes or cookieauth=yes query string parameters. These parameters are currently not used anywhere else, so you can also block them globally without negative side-effects.

Product

Versions

Indico

>= 3.3.3 (semver)

CPE

cpe:2.3:a:cern:indico:*:*:*:*:*:*:*:*

Remediation

Upgrade: 3.3.14moderate efforthttps://github.com/indico/indico/releases/tag/v3.3.14
Workaround:low effort
Disable the HTTP API cache by setting the TTL to 0 on /admin/api/.
Mitigation:low effort
Block access to paths below /export/ that contain the ca=yes or cookieauth=yes query string parameters. These parameters are currently not used anywhere else, so you can also block them globally without negative side-effects.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 14, 2026	CVE Modified	CISA-ADP
Oct 13, 2026	New CVE Received	[email protected]