CVE-2026-28352

The record

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.

Affected packages

Related vulnerabilities

• GHSA-rfpp-2hgm-gp5v Indico has a missing access check in the event series management API Same vulnerability
• CVE-2026-25739 Indico is an event management system that uses Flask-Multipass, a multi-backend… Also affects indico
• CVE-2026-25738 Indico is an event management system that uses Flask-Multipass, a multi-backend… Also affects indico
• GHSA-jxc4-54g3-j7vp Indico Affected by Cross-Site-Scripting via material uploads Also affects indico
• GHSA-f47c-3c5w-v7p4 Indico has Server-Side Request Forgery (SSRF) in multiple places Also affects indico
• CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
• CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306