← Vulnerability feed

Vulnerability record · CVE-2026-28352 · published 27 February 2026

CVE-2026-28352: Cern indico missing authentication for critical function vulnerability

Cern · Indico

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.

6.5 CVSS 3.1 Medium EPSS 0.36% · top 73.2% CWE-306 · Missing authentication for critical function
6.5CVSS 3.1 base score
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/indico/indico/releases/tag/v3.3.11 ProductRelease Notes
https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v MitigationPatchVendor Advisory

Track CVE-2026-28352 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.7CVE-2026-33046Cern indico path traversal vulnerabilityIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to …EPSS 1.0%7.5CVE-2024-50633Cern indico vulnerabilityA Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST reque…EPSS 0.63%7.5CVE-2021-30185Cern indico vulnerabilityCERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.EPSS 1.0%6.9CVE-2026-25738Cern indico toctou race condition vulnerabilityIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnera…EPSS 0.33%6.1CVE-2024-45399Cern indico cross-site scripting vulnerabilityIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, co…EPSS 0.38%5.4CVE-2026-25739Cern indico cross-site scripting vulnerabilityIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnera…EPSS 0.29%5.4CVE-2025-59035Cern indico cross-site scripting vulnerabilityIndico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a C…EPSS 0.20%5.4CVE-2023-37901Cern indico cross-site scripting vulnerabilityIndico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts co…EPSS 0.52%

Source: NIST National Vulnerability Database (record CVE-2026-28352), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.