CVE-2026-108388: fallo de gravedad baja en indico
Indico legacy contribution export cache poisoning discloses restricted metadata
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.5epss 0.3%
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Productos afectados
indico · indicoCVEs relacionadas — indico
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-33046HIGHIndico discloses local files resulting in Remote Code Execution through LaTeX injectionEPSS 0.8%CVE-2025-53640MEDIUMIndico vulnerable to user enumeration via API endpointEPSS 0.7%CVE-2023-37901MEDIUMCross-Site-Scripting via confirmation promptsEPSS 0.5%CVE-2024-45399MEDIUMIndico has a Cross-Site-Scripting during account creationEPSS 0.4%CVE-2026-107394MEDIUMIndico: Incomplete Server-Side Request Forgery (SSRF) checkEPSS 0.3%CVE-2026-28352MEDIUMIndico missing access check in event series management APIEPSS 0.3%