Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107394Indico: Incomplete Server-Side Request Forgery (SSRF) check

Medium 6.8

In plain English

A medium-severity server-side request forgery in indico from indico. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 72.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	indico	3.3.13	GHSA-2v95-h47v-g4x9
PyPI	indico	3.3.13	PYSEC-2026-4225

Affected products (as reported)

Vendor	Product	Versions
indico	indico	< 3.3.13

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9 x_refsource_CONFIRM
https://github.com/indico/indico/pull/7573 x_refsource_MISC
https://github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736 x_refsource_MISC
https://github.com/indico/indico/releases/tag/v3.3.13 x_refsource_MISC