Read the docs

indico

Records29All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

indico records in CISA KEV

No indico vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Indico 11 records HIGH Rucio 8 records HIGH Root 1 record MEDIUM

Records

11 records in Indico · all components

TI-2024-34052 CVE-2024-50633 · GHSA-3wg7-r7q5-r2jf

Authorization bypass in Indico

Priority HIGH 72

A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2025-01-16 Fixed in 3.3.3 CWE-201
TI-2026-22632 CVE-2026-28352 · GHSA-rfpp-2hgm-gp5v

Indico missing access check in event series management API

Priority LOW 35

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00299 Published 2026-02-27 Fixed in 3.3.11 CWE-306
TI-2024-30448 CVE-2024-45399 · GHSA-rrqf-w74j-24ff

Indico has a Cross-Site-Scripting during account creation

Priority LOW 27

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00383 Published 2024-09-04 Fixed in 3.3.4 CWE-1395
TI-2025-33566 CVE-2025-53640 · GHSA-q28v-664f-q6wj

Indico vulnerable to user enumeration via API endpoint

Priority LOW 25

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00662 Published 2025-07-14 Fixed in 3.3.7 CWE-200
TI-2023-19334 CVE-2023-37901 · GHSA-fmqq-25x9-c6hm

Cross-Site-Scripting via confirmation prompts

Priority LOW 25

Indico is an open source a general-purpose, web based event management tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2023-07-21 Fixed in 3.2.6 CWE-79
TI-2026-20807 CVE-2026-25739 · GHSA-jxc4-54g3-j7vp

Indico affected by Cross-Site-Scripting via material uploads

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-19 Fixed in 3.3.10 CWE-79
TI-2025-36677 CVE-2025-59035 · GHSA-7cf7-9wrr-vrf4

Indico vulnerable to Cross-Site Scripting via LaTeX math code

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00206 Published 2025-09-10 Fixed in 3.3.8 CWE-79
Open these records in search →