Indico vulnerable to user enumeration via API endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-639.
Summary
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| indico | indico | 2.2 to before 3.3.7 | 3.3.7 | Patch available | CNA |
| — | indico (PyPI) | 2.2 to before 3.3.7 | 3.3.7 | Patch available | GHSA-q28v-664f-q6wj |
- indico Vendorindico Affected 2.2 to before 3.3.7 Fixed in 3.3.7 Patch available CNA
- indico (PyPI) Vendor— Affected 2.2 to before 3.3.7 Fixed in 3.3.7 Patch available GHSA-q28v-664f-q6wj
Remediation
- Fix · CNA indico (indico) Fixed in 3.3.7
- Fix · GHSA-q28v-664f-q6wj indico (PyPI) Fixed in 3.3.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53640
- 2026-10-03 Alias added: GHSA-q28v-664f-q6wj
- 2026-10-16 EPSS moved to the 50th–90th percentile
References
Exploit 2
Advisory 2
Other 5
- https://docs.getindico.io/en/stable/config/settings/#ALLOW_PUBLIC_USER_SEARCH
- https://docs.getindico.io/en/stable/installation/upgrade
- https://github.com/indico/indico/releases/tag/v3.3.7
- https://github.com/indico/indico/pull/6936/commits/f8583557a3da56aeea8857ae69bf17c9066c95c1
- https://github.com/indico/indico
More Indico vulnerabilities
- TI-2024-34052 Authorization bypass in Indico CVSS 3.1HIGH 7.5
- TI-2026-25492 Indico discloses local files resulting in Remote Code Execution through LaTeX injection CVSS 4.0HIGH 7.7
- TI-2026-20806 Indico has Server-Side Request Forgery (SSRF) in multiple places CVSS 4.0MEDIUM 6.9
- TI-2026-22632 Indico missing access check in event series management API CVSS 3.1MEDIUM 6.5
- TI-2021-10724 CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link. CVSS 3.1HIGH 7.5
- TI-2024-30448 Indico has a Cross-Site-Scripting during account creation CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-53640 · CVE Program
- CVE-2025-53640 · NVD
- FIRST EPSS
- GHSA-q28v-664f-q6wj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences