CVE-2025-53640mediumCWE-200CWE-639CWE-862

CVE-2025-53640: falha de média gravidade em indico

Indico vulnerable to user enumeration via API endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar indico+ Monitorar indico

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.7%
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
indico · indico
CVEs relacionadas — indico

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33046HIGHIndico discloses local files resulting in Remote Code Execution through LaTeX injectionEPSS 0.8%CVE-2023-37901MEDIUMCross-Site-Scripting via confirmation promptsEPSS 0.5%CVE-2024-45399MEDIUMIndico has a Cross-Site-Scripting during account creationEPSS 0.4%CVE-2026-107394MEDIUMIndico: Incomplete Server-Side Request Forgery (SSRF) checkEPSS 0.3%CVE-2026-28352MEDIUMIndico missing access check in event series management APIEPSS 0.3%CVE-2026-25738MEDIUMIndico has Server-Side Request Forgery (SSRF) in multiple placesEPSS 0.3%