CVE-2026-107395

4.3 MEDIUMpublic exploit available

Published 2026-10-08 · Updated 2026-10-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/indico/indico/commit/524e8e93eadcd8484905b1147020a35f5dce6038
https://github.com/indico/indico/releases/tag/v3.3.13
https://github.com/indico/indico/security/advisories/GHSA-6p4f-j8j6-463q

All references

https://github.com/indico/indico/commit/524e8e93eadcd8484905b1147020a35f5dce6038
https://github.com/indico/indico/releases/tag/v3.3.13
https://github.com/indico/indico/security/advisories/GHSA-6p4f-j8j6-463q

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
HIGHCVE-2025-71433PoC
MEDIUMCVE-2026-0198
HIGHCVE-2026-100217
CRITICALCVE-2026-100240
HIGHCVE-2026-100266

Related by shared AI tags and CWE weakness class. Browse the full archive.