CVE-2026-107394 json
Indico: Incomplete Server-Side Request Forgery (SSRF) check
published 2026-10-08 31 d ago modified 2026-10-15 25 d ago also EUVD-2026-95212 , GHSA-2v95-h47v-g4x9 , PYSEC-2026-4225
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
Patch / fix
- pypi indico 3.3.13
- cern indico 3.3.13
- github.com/indico/indico@44540e7 commit
- github.com/indico/indico#7573 pull request
- github.com/indico/indico/releases/tag/v3.3.13 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 31 d ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| OSV | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | indico | <3.3.13 |
3.3.13 |
Affected products
- indico indico
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/indico/indico/pull/7573
web
-
github.com
/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736
web
-
github.com
/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9
web
-
github.com
/indico/indico/releases/tag/v3.3.13
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-107394
advisory
-
github.com
/indico/indico
package
-
pypi.org
/project/indico
package
-
github.com
/advisories/GHSA-2v95-h47v-g4x9
advisory
Sources
- CVE List CVE-2026-107394
- GitHub Advisory GHSA-2v95-h47v-g4x9
- NVD CVE-2026-107394
- OSV PYSEC-2026-4225
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.