CVE-2026-108388

Katalog CVE

CVSS 3.5 · Low

Kerentanan Incorrect Authorization. Skor CVSS 3.1 3.5 (Low) menurut github.com.

Deskripsi (NVD)

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Received

CVSS 3.1

3.5 (Low), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/indico/indico/commit/0e71da31fc21d0ed0ce687cce5b745ba2fad0b92
• https://github.com/indico/indico/commit/5985cfa65a3441b7d3ca4ef1a9dc177c82ea0f26
• https://github.com/indico/indico/releases/tag/v3.3.14
• https://github.com/indico/indico/security/advisories/GHSA-p9vj-86c7-h7q3