Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
16 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints. The previous fix (CVE-2026-25738) did not cover an edge case so it was still possible to craft a URL that pointed to a local target but was accepted as valid by Indico. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds If you do not have IPs that expose sensitive data without authentication (typically because you do not host Indico on AWS), this vulnerability doesn't impact you and you can ignore it (but please upgrade anyway). Also, only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. So if you trust your event organizers, the risk is also very limited. For additional security, both…
Recommended action: Upgrade to 3.3.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds Restrict access to the event itself For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately at indico-team@cern.ch
Recommended action: Upgrade to 3.3.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of updating. - Only let trustworthy users create content (including minutes which speakers can typically do as well) on Indico. For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately at indico-team@cern.ch
Recommended action: Upgrade to 3.3.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of updating. - Only let trustworthy users manage events or create content (including material uploads which speakers can typically do as well) on Indico. For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately at indico-team@cern.ch
Recommended action: Upgrade to 3.3.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
[!NOTE] If server-side LaTeX rendering is not in use (ie XELATEXPATH was not set in indico.conf), this vulnerability does not apply. Impact Due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Patches It is recommended to update to Indico 3.3.12 as soon as possible. See the docs for instructions on how to update. It is also strongly recommended to enable the containerized LaTeX renderer (using podman), which isolates it from the rest of the system. See the docs for details - it is very easy and from now on the only recommended/supported way of using LaTeX. Workarounds Remove the XELATEXPATH setting from indico.conf (or comment it out or set it to None) and restart the indico-uwsgi and indico-celery services to disable LaTeX functionality. For more information For any…
Recommended action: Upgrade to 3.3.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to: - Getting the metadata (title, category chain, start/end date) for events in an existing series - Deleting an existing event series: This just removes the series metadata, ie (if enabled) the links between events in the same series and the lecture series number in the event title - Modifying an existing event series: Just like for deleting, it would only allow to toggle the metadata display. It could also be used to set an event title pattern for the series, but this is only used when cloning an event from that series. That this vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Patches Developers should to update to Indico 3.3.11 as soon as possible. See the docs for instructions on how to update.…
Recommended action: Upgrade to 3.3.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a Cross-Site-Scripting vulnerability when uploading certain file types as materials. Patches You should to update to Indico 3.3.10 as soon as possible. See the docs for instructions on how to update. Please be aware that to apply the fix itself updating is sufficient, but to benefit from the strict Content-Security-Policy we now apply by default for file downloads, you need to update your webserver config in case you use nginx with Indico's STATICFILEMETHOD set to xaccelredirect and add the following line to the .xsf/indico/ location block (you can consult the Indico setup documentation for the full configuration snippet): Workarounds - Use your webserver config to apply a strict CSP for material download endpoints. - Only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico. For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately…
Recommended action: Upgrade to 3.3.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints. Patches You should to update to Indico 3.3.10 as soon as possible. See the docs for instructions on how to update. Workarounds If you do not have IPs that expose sensitive data without authentication (typically because you do not host Indico on AWS), this vulnerability doesn't impact you and you can ignore it (but please upgrade anyway). Also, only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. So if you trust your event organizers, the risk is also very limited. For additional security, both before and after patching, you could also use the common proxy-related environment variables (in particular httpproxy and httpsproxy) to force outgoing requests to go…
Recommended action: Upgrade to 3.3.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds Only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows. For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately at indico-team@cern.ch
Recommended action: Upgrade to 3.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds It is possible to restrict access to the affected API (e.g. in the webserver config) which is most likely unused anyway and thus will not break anything. For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately at indico-team@cern.ch
Recommended action: Upgrade to 3.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. [!TIP] If your instance allows everyone to create a user account, and you wish to truly restrict access to these user details, consider restricting user search to managers. You can find details on the newly introduced indico.conf setting ALLOWPUBLICUSERSEARCH in our documentation. Patches You should to update to Indico 3.3.7 as soon as possible. See the docs for instructions on how to update. Workarounds It is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended. For more information If you have any questions or comments about this advisory: - Open a thread in our forum - Email us privately at…
Recommended action: Upgrade to 3.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Broken Object Level Authorization (BOLA) vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals.
Recommended action: Upgrade to 3.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a Cross-Site-Scripting vulnerability during account creation when redirecting after the account has been successfully created. Exploitation requires the user to initiate the account creation process with a maliciously crafted link, and then finalize the signup process. Because of this, it can only target newly created (and thus unprivileged) Indico users so the benefits of exploiting it are very limited. Patches You should to update to Indico 3.3.4 as soon as possible. See the docs for instructions on how to update. Workarounds - If you build the Indico package yourself and cannot upgrade for some reason, you can simply update the flask-multipass dependency to =0.5.5 which fixes the vulnerability. You would do that by editing requirements.txt before building the package (see commit 7dcb573837), or possibly cherry-picking that particular commit. - Otherwise you could configure your web server to disallow requests containing a query string with a parameter that starts…
Recommended action: Upgrade to 3.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Patches You need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Workarounds Only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites…
Recommended action: Upgrade to 3.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's URL generation logic which could have allowed an attacker to make Indico send a password reset link with a valid token pointing to an attacker-controlled domain by sending that domain in the Host header. Had a user clicked such a link without realizing it does not point to Indico (and that they never requested it), it would have revealed their password reset token to the attacker, allowing them to reset the password for that user and thus take over their Indico account. - If the web server already enforces a canonical host name, this cannot be exploited (this was not part of the default config from the Indico setup guide) - If only SSO is used (LOCALIDENTITIES set to False), the vulnerability cannot be exploited for password reset links, but other links in emails set by Indico could be tampered with in the same way (with less problematic impact though) Patches You need to update to Indico 2.3.4…
Recommended action: Upgrade to 2.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Local file disclosure through LaTeX injection Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. indico.conf). As far as we know it is not possible to write files or execute code using this vulnerability. Patches You need to update to Indico 2.2.3 as soon as possible. We also released Indico 2.1.10 in case you cannot update to 2.2 for some reason. See https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update. Workarounds Setting XELATEXPATH = None in indico.conf will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused. For more information If you have any questions or comments about this advisory: Open a thread in our forum Email us privately at indico-team@cern.ch
Recommended action: Upgrade to 2.2.3 or 2.1.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.