CVE-2025-59034

Katalog CVE

CVSS 4.3 · Medium EPSS 0,26%

Kerentanan Authorization Bypass Through User-Controlled Key pada cern indico. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

Rincian

Terbit di NVD

10 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 15,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/indico/indico/security/advisories/GHSA-4269-mcfh-cp7q patch · advisory vendor
• https://github.com/indico/indico/releases/tag/v3.3.8 release notes