Indico Tampering with links (e.g. password reset) in sent emails

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2021-30185: 1.05% estimated exploitation activity in the next 30 days; percentile 64.25 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's URL generation logic which could have allowed an attacker to make Indico send a password reset link with a valid token pointing to an attacker-controlled domain by sending that domain in the Host header. Had a user clicked such a link without realizing it does not point to Indico (and that they never requested it), it would have revealed their password reset token to the attacker, allowing them to reset the password for that user and thus take over their Indico account. - If the web server already enforces a canonical host name, this cannot be exploited (this was not part of the default config from the Indico setup guide) - If only SSO is used (LOCALIDENTITIES set to False), the vulnerability cannot be exploited for password reset links, but other links in emails set by Indico could be tampered with in the same way (with less problematic impact though) Patches You need to update to Indico 2.3.4…

Published by the source

8 Apr 2021, 16:33 UTC

Last modified by the source

23 Sep 2024, 16:36 UTC

Source last checked

26 Oct 2026, 13:17 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-wgpj-7c2j-vfjm

2. Revision 2 · amended · 25 Oct 2026

   Reviewed OSV alias/range/CVSS4 correction; package source scopes and original publication preserved. No customer finding resolved.

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-wgpj-7c2j-vfjm

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2021-30185

Advisory: Indico Tampering with links (e.g. password reset) in sent emails
IDs: CVE-2021-30185, GHSA-wgpj-7c2j-vfjm
Record: https://patchnext.com/advisories/cve-2021-30185 (revision 3, source checked 26 Oct 2026, 13:17 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: indico 2.3.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI indico: affected < 2.3.4; fixed in 2.3.4

## Suggested inspection (read-only)
- `python -m pip show indico`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on indico.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-wgpj-7c2j-vfjm (OSV record GHSA-wgpj-7c2j-vfjm lists affected ranges: PyPI indico >=0 <2.3.4 (fixed))
- Verified: https://github.com/advisories/GHSA-wgpj-7c2j-vfjm (GitHub-reviewed advisory GHSA-wgpj-7c2j-vfjm lists affected ranges: PyPI indico >=0 <2.3.4)

Commands are suggestions: review each one before running it.