CVE-2026-107395: Indico Session Data Disclosure Vulnerability

CVE-2026-107395 Overview

CVE-2026-107395 is a missing authorization vulnerability [CWE-862] in Indico, an open-source event management system that integrates with Flask-Multipass for authentication. The flaw resides in the legacy session export API. An authenticated user with access to an event can query the API to retrieve metadata for restricted sessions inside that event, bypassing the per-session access check. Disclosed metadata includes session titles, descriptions, and conveners. The issue affects Indico versions prior to 3.3.13 and is resolved in version 3.3.13.

Critical Impact
Authenticated users can enumerate metadata of restricted sessions within accessible events, leaking titles, descriptions, and convener information intended to remain private.

Affected Products

Indico event management system versions prior to 3.3.13
Deployments exposing the legacy session export API
Instances relying on per-session access restrictions within shared events

Discovery Timeline

2026-10-08 - CVE-2026-107395 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107395

Vulnerability Analysis

The vulnerability exists in Indico's legacy export API path that aggregates session blocks for a given event. When the API serializes sessions associated with an event, it iterates over each session and returns its metadata without first evaluating whether the requesting user is permitted to access that session. Only event-level access is enforced, not session-level access.

As a result, any authenticated user who can view the containing event can retrieve data about sessions that administrators have explicitly restricted. The exposed fields include the session title, description, and the list of conveners. Integrity and availability are not affected because the endpoint is read-only.

Root Cause

The root cause is a missing authorization check [CWE-862] in the session aggregation loop within indico/modules/events/api.py. The code assumed event-level permissions were sufficient and did not call session_.can_access(self.user) on each session before serialization.

Attack Vector

Exploitation requires a valid authenticated account and network access to the Indico instance. The attacker queries the legacy sessions API for an event they can access, then parses the response for sessions they should not be able to see. No user interaction and no elevated privileges are required beyond standard authenticated access.

python

         """Return an aggregated list of session blocks given the sessions."""
         session_blocks = []
         for session_ in sessions:
+            if not session_.can_access(self.user):
+                continue
             can_manage = self.user is not None and session_.can_manage(self.user)
             session_access_list = None
             serialized_session = self._serialize_session(session_)

The patch adds an explicit can_access check that skips any session the requesting user is not authorized to view. Source: GitHub Commit 524e8e9.

Detection Methods for CVE-2026-107395

Indicators of Compromise

Unusual volume of requests from a single authenticated user to legacy session export endpoints under /export/event/ or related session APIs.
API responses containing session metadata for events where the requesting account has limited role assignments.
Access patterns where the same account enumerates sessions across many events in a short window.

Detection Strategies

Review Indico application logs for authenticated calls to the legacy sessions export API and correlate against the user's session-level permissions.
Baseline normal export API usage per user role and alert on deviations, particularly automated or scripted enumeration.
Compare the sessions returned to a user via the API against the sessions visible to that user in the Indico web interface to identify discrepancies.

Monitoring Recommendations

Enable verbose HTTP access logging on the Indico web tier and forward logs to a central analytics platform.
Monitor for repeated 200 responses from legacy session export endpoints originating from low-privilege accounts.
Track authentication events and API usage per account to detect credential misuse that could amplify this disclosure.

How to Mitigate CVE-2026-107395

Immediate Actions Required

Upgrade Indico to version 3.3.13 or later, which contains the authorization fix.
Audit prior access logs for authenticated calls to the legacy session export API and identify accounts that may have retrieved restricted session metadata.
Review event and session access control lists to ensure they reflect the intended visibility of sensitive sessions.

Patch Information

The fix is included in Indico 3.3.13. Review the Indico v3.3.13 release notes and the GitHub Security Advisory GHSA-6p4f-j8j6-463q for upgrade guidance. The underlying code change is published in GitHub Commit 524e8e9.

Workarounds

Restrict access to the legacy session export API at the reverse proxy or web application firewall until the upgrade is applied.
Limit account provisioning so that only trusted users can authenticate to events containing restricted sessions.
Remove or redact sensitive content from session titles and descriptions on affected versions until patching is complete.

bash

# Example: upgrade Indico via pip in the application virtual environment
source /opt/indico/.venv/bin/activate
pip install --upgrade "indico>=3.3.13"
indico db upgrade
systemctl restart indico-uwsgi.service