CVE-2026-28352 Details
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.
A vulnerability in Indico's event management system, specifically in versions prior to 3.3.11, allows unauthenticated and unauthorized access to the API endpoint that manages event series. This endpoint lacks proper access checks, enabling users to retrieve metadata (such as titles, category chains, and event dates) for events within a series, as well as to delete or modify existing event series. However, this vulnerability does not permit unauthorized access to detailed event content or the ability to alter user-visible data within events.
Users are advised to update Indico to version 3.3.11 or later. Instructions for upgrading can be found in the Indico documentation. As an additional step, use a web server to restrict access to the event series management API endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/indico/indico/releases/tag/v3.3.11 | [email protected] | ProductRelease Notes |
| https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cern indico | < 3.3.11 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Feb 27, 2026 | New CVE Received | [email protected] |