CVE-2026-107396: Indico Event Management System XSS Vulnerability

CVE-2026-107396 Overview

CVE-2026-107396 is a stored cross-site scripting (XSS) vulnerability in Indico, an open-source event management system that uses Flask-Multipass for authentication. The flaw affects Indico versions prior to 3.3.13. Users with event management privileges or content creation rights, including speakers who upload material, can store crafted javascript: URLs in fields that accept custom URLs. When a victim clicks one of these links, the attacker-controlled script executes in the victim's browser under the Indico origin. The vulnerability is tracked as [CWE-692: Incomplete Denylist to Cross-Site Scripting].

Critical Impact
Authenticated users with content submission or event management rights can inject persistent javascript: URLs that execute arbitrary script in a victim's browser session within the Indico application origin.

Affected Products

Indico event management system versions prior to 3.3.13
Deployments using Flask-Multipass authentication backends
Instances that permit speaker material uploads or custom link submissions

Discovery Timeline

2026-10-08 - CVE-2026-107396 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107396

Vulnerability Analysis

The vulnerability resides in Indico form handlers that accept user-supplied URLs for attachments, event materials, and other custom link fields. The application did not restrict the URL scheme on these inputs, allowing javascript: URIs to pass validation and be stored in the database. When another user later clicked the rendered hyperlink, the browser evaluated the JavaScript payload in the context of the Indico origin.

Exploitation requires at least submitter or event management privileges and a user interaction (clicking the link). The attacker-controlled script runs with the victim's session, enabling actions such as session token theft, CSRF-style requests against Indico APIs, or defacement of event content.

Root Cause

The underlying defect is an incomplete input validation in WTForms-based URL fields. The attachments/forms.py module used a generic URL field without applying the URL validator, which would have constrained accepted schemes. Combined with rendering routines that output the stored URL into an href attribute, this permitted javascript: payloads to persist and later execute.

Attack Vector

An authenticated attacker with speaker, submitter, or management access to an event crafts a URL field value such as javascript:/*...*/ containing the malicious payload. The value is stored unmodified. A victim with access to the same event follows the rendered link, and the browser executes the payload against the Indico origin.

python

 from flask import session
 from wtforms.fields import BooleanField, TextAreaField, URLField
 from wtforms.fields.simple import HiddenField, StringField
-from wtforms.validators import DataRequired, Optional, ValidationError
+from wtforms.validators import URL, DataRequired, Optional, ValidationError
 from wtforms_sqlalchemy.fields import QuerySelectField

 from indico.core.config import config

Source: GitHub commit d4c8c71. The patch adds the URL validator to constrain accepted schemes on custom link inputs.

Detection Methods for CVE-2026-107396

Indicators of Compromise

Attachment, material, or custom-link records whose URL value begins with javascript:, data:, or vbscript: schemes.
Browser console errors or unexpected script execution originating from event pages hosting user-submitted links.
Audit log entries showing speakers or submitters editing URL fields shortly before user reports of session anomalies.

Detection Strategies

Query the Indico database for stored URLs matching non-HTTP(S) schemes across attachment, contribution, and event link tables.
Review web server access logs for referrers pointing to event pages followed by requests consistent with session or token exfiltration.
Correlate authenticated user activity with modification of custom link fields to identify suspicious submitters.

Monitoring Recommendations

Enable application-level logging for form submissions that modify URL fields and alert on non-http(s) schemes.
Monitor outbound requests from the Indico origin for unusual destinations suggestive of cookie or token exfiltration.
Track account privilege changes that grant submitter or management rights, especially to newly created accounts.

How to Mitigate CVE-2026-107396

Immediate Actions Required

Upgrade Indico to version 3.3.13 or later, which enforces the URL validator on custom link fields.
Audit existing attachment and custom-link records for stored javascript: or other non-HTTP(S) schemes and remove them.
Review the roster of users with event management and submitter privileges and revoke unnecessary access.

Patch Information

The fix is included in Indico release v3.3.13 and merged via pull request #7619. Technical details are documented in GitHub Security Advisory GHSA-c4wc-ggrj-jg9v and the corresponding commit d4c8c71.

Workarounds

Restrict event submission and management privileges to trusted users until the patch is applied.
Deploy a Content Security Policy (CSP) that disallows inline script and javascript: URI execution for the Indico origin.
Instruct users to avoid clicking unverified links in event pages and material listings pending remediation.

bash

# Upgrade Indico to the patched release
pip install --upgrade 'indico>=3.3.13'
indico db upgrade
systemctl restart indico-celery indico-uwsgi