CVE-2026-107397: Indico Flask-Multipass XSS Vulnerability

CVE-2026-107397 Overview

Indico is an open-source event management system that integrates Flask-Multipass for multi-backend authentication. A stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affects Indico versions prior to 3.3.13. Users with content creation privileges, including speakers authorized to create minutes, can embed crafted HTML into event minutes. When two users edit the same minutes concurrently, the conflict resolution UI renders the attacker-controlled payload. The script executes in the viewer's browser under the Indico origin. Version 3.3.13 remediates the issue.

Critical Impact
Authenticated users with minute-editing privileges can execute arbitrary JavaScript in another editor's browser session within the Indico origin, enabling session abuse and content tampering.

Affected Products

Indico event management system versions prior to 3.3.13
Deployments exposing collaborative minute-editing to multiple users
Instances using Flask-Multipass authentication with user-contributed content

Discovery Timeline

2026-10-08 - CVE-2026-107397 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-107397

Vulnerability Analysis

The flaw resides in Indico's minute editor conflict resolution interface. When two authorized users simultaneously edit the same minutes, Indico presents a merge-style UI to reconcile divergent content. The conflict view fails to sanitize HTML stored in minute content before rendering it in the editor's DOM. An attacker with minute-editing privileges can seed the content with a crafted HTML payload. When a second editor opens the conflict UI, the browser parses the payload and executes attacker-controlled JavaScript under the Indico origin.

Root Cause

The root cause is improper neutralization of input during web page generation in the minute editor conflict handler. Indico's standard note rendering path applied sanitization, but the conflict resolution component rendered content through a path that bypassed those protections. The upstream fix also hardens URL validation in attachment forms, indicating a broader review of unsanitized user input across note-handling flows.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit minutes, such as a speaker contributing session notes. The attacker injects HTML containing a script payload into minutes they are authorized to edit. A second privileged user, typically an event manager or co-editor, must then edit the same minutes concurrently and trigger the conflict resolution UI. The payload executes in the victim's browser within the Indico session context.

python

# Patch excerpt - indico/modules/attachments/forms.py
# Adds URL validator to prevent javascript: and other unsafe schemes
from wtforms.fields import BooleanField, TextAreaField, URLField
from wtforms.fields.simple import HiddenField, StringField
-from wtforms.validators import DataRequired, Optional, ValidationError
+from wtforms.validators import URL, DataRequired, Optional, ValidationError
from wtforms_sqlalchemy.fields import QuerySelectField

from indico.core.config import config

Source: Indico security commit d4c8c71

Detection Methods for CVE-2026-107397

Indicators of Compromise

Minute content containing <script> tags, inline event handlers such as onerror and onload, or javascript: URIs stored in event minutes
Browser console errors or unexpected network requests originating from the Indico origin while viewing minute conflict resolution screens
Audit log entries showing rapid concurrent edits to the same minute object by low-privilege contributors and higher-privilege editors

Detection Strategies

Query the Indico database for stored minute content containing HTML sinks or script-like substrings and review entries created by non-management users
Instrument the Indico frontend with a Content Security Policy (CSP) report endpoint to capture inline script execution attempts in the conflict UI
Review web server access logs for unusual POST patterns to minute endpoints that correlate with conflict resolution views

Monitoring Recommendations

Alert on authenticated sessions that generate outbound requests to external domains immediately after loading minute editor views
Track Indico application version in asset inventory and flag any instance running a release below 3.3.13
Monitor privileged administrator sessions for anomalous actions following interaction with user-contributed minutes

How to Mitigate CVE-2026-107397

Immediate Actions Required

Upgrade all Indico deployments to version 3.3.13 or later as published in the official release
Audit existing minute content for stored HTML payloads before administrators or event managers open them
Restrict minute creation and editing privileges to trusted contributors until the patch is applied

Patch Information

The vulnerability is fixed in Indico release v3.3.13. The remediation is documented in GitHub Pull Request #7619 and consolidated in commit d4c8c71. The fix sanitizes minute content on the conflict resolution path and adds URL validation to attachment forms. Refer to GitHub Security Advisory GHSA-cw24-x4mj-fw3q for the vendor advisory.

Workarounds

Temporarily revoke minute editing permissions from untrusted speakers and limit edits to a single designated editor to avoid conflict scenarios
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to the Indico origin
Instruct event managers to review minute content in a read-only context before engaging with the conflict resolution UI

bash

# Upgrade Indico to the patched release
pip install --upgrade 'indico>=3.3.13'

# Verify installed version
indico --version

# Restart Indico services after upgrade
systemctl restart indico-celery indico-uwsgi