cyfenced.com →

[ CVE-2026-107394 · Published 8 Oct 2026 ]

Indico: Incomplete Server-Side Request Forgery (SSRF) check

CVSS 6.8 EPSS <1%Fix available

[ Description ]Official description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.

[ Fixes ]Fixes and patches

  • indico 3.3.13Fixed version · GitHub Advisories · pip package indico: upgrade to 3.3.13 or later (affected < 3.3.13)

[ Packages ]Affected open-source packages

[ References ]References