CVE-2026-108388: Indico Auth Bypass Vulnerability

CVE-2026-108388 Overview

CVE-2026-108388 is an incorrect authorization vulnerability [CWE-863] in Indico, an open-source event management system. Versions 3.3.3 through 3.3.13 improperly check inherited event contribution-management permissions by using the ambient web-session user rather than the user object passed to Contribution.can_manage. A low-privileged attacker can induce a privileged user to request a crafted legacy contribution export, causing speaker and author email addresses along with contribution access-control entries to be cached by the API. The attacker can then retrieve those cached entries with lower privileges. The issue was fixed in Indico 3.3.14.

Critical Impact
Low-privileged users can obtain speaker/author email addresses and contribution access-control entries that should require elevated event-management privileges to view.

Affected Products

Indico 3.3.3 through 3.3.13
Fixed in Indico 3.3.14
Event management deployments using legacy contribution export endpoints

Discovery Timeline

2026-10-13 - CVE CVE-2026-108388 published to NVD
2026-10-13 - Last updated in NVD database
Indico 3.3.14 - Vendor released patched version via GitHub Release v3.3.14

Technical Details for CVE-2026-108388

Vulnerability Analysis

The vulnerability resides in Contribution.can_manage within indico/modules/events/contributions/models/contributions.py. When checking inherited management rights via the parent event, the method called self.event.can_manage(session.user, permission='contributions') instead of passing the user argument supplied to the function. This substituted the authenticated web-session user for the user whose permissions were actually being evaluated.

As a result, authorization decisions made during API cache population reflected the privileges of the requesting session rather than the subject user. When a privileged user was induced to trigger a legacy contribution export, the resulting cache entry included speaker and author email addresses and contribution access-control entries. A less-privileged user requesting the same cached endpoint could then retrieve that sensitive data.

Root Cause

The root cause is an argument-passing mistake in the parent access check. The function received a user parameter but referenced the global session.user for the inherited contributions permission check, breaking the contract that can_manage evaluates the supplied user.

Attack Vector

Exploitation requires a low-privileged authenticated account and user interaction from a higher-privileged user. The attacker crafts a legacy contribution export URL, convinces a manager-level user to open it, and the server stores the privileged response in the shared API cache. The attacker then issues the matching request and reads the cached speaker/author emails and ACL entries.

python

# Patch: Use correct user in parent access check
# File: indico/modules/events/contributions/models/contributions.py
        if super().can_manage(user, permission, allow_admin=allow_admin, check_parent=check_parent,
                              explicit_permission=explicit_permission):
            return True
-        if check_parent and self.event.can_manage(session.user, permission='contributions'):
+        if check_parent and self.event.can_manage(user, permission='contributions'):
            return True
        if (check_parent and self.session_id is not None and
                self.session.can_manage(user, 'coordinate', allow_admin=allow_admin,

Source: GitHub Commit Fix

Detection Methods for CVE-2026-108388

Indicators of Compromise

Legacy contribution export API requests originating from low-privileged accounts followed shortly by identical requests from higher-privileged users.
Unexpected API cache hits returning speaker or author email data to users without contributions management permission.
Access logs showing crafted contribution export URLs shared via chat, email, or ticketing systems targeting event managers.

Detection Strategies

Review Indico application logs for sequences where a privileged user accesses a legacy contribution export shortly after a low-privileged user requested the same resource.
Audit API cache hit/miss patterns for contribution export endpoints to identify data served to users below the expected privilege tier.
Correlate HTTP referrer and user-agent fields with session-user identity to flag user-interaction-triggered export requests.

Monitoring Recommendations

Enable verbose logging on the Indico contributions and events modules during triage to capture can_manage evaluation context.
Monitor outbound exports of email address fields and ACL entries from the contributions API for anomalous access patterns.
Alert on repeated requests to legacy contribution export endpoints from accounts lacking event management roles.

How to Mitigate CVE-2026-108388

Immediate Actions Required

Upgrade Indico to version 3.3.14 or later, which contains the authorization fix.
Invalidate existing API caches after upgrade to purge any entries populated with over-shared contribution data.
Audit contribution access-control entries and notify affected speakers or authors if email disclosure is suspected.

Patch Information

The fix is included in Indico 3.3.14, released via GitHub Release v3.3.14. The code change passes the correct user argument to self.event.can_manage instead of session.user. Review the GitHub Security Advisory GHSA-p9vj-86c7-h7q3 and the GitHub Commit Fix for implementation details. A related change introduces a dedicated contributions event management permission; see the GitHub Commit Update.

Workarounds

Restrict access to legacy contribution export endpoints at the reverse-proxy layer until upgrade is complete.
Advise event managers to avoid opening unsolicited contribution export links shared by lower-privileged users.
Reduce or disable API caching for contribution export routes to prevent cross-privilege data reuse.

bash

# Upgrade Indico via pip to the patched release
pip install --upgrade 'indico==3.3.14'

# Restart Indico services after upgrade
systemctl restart indico-celery indico-uwsgi