CVE-2023-37901
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Indico, a web-based event management tool, has a Cross-Site Scripting vulnerability in confirmation prompts used for deleting content. Exploitation requires someone with submission privileges to attempt to delete content, creating an attack risk.
Risk Assessment
The risk of an attack increases when event organizers want to delete suspicious content, and the attack may be supported by social engineering. Users should update to Indico 3.2.6 as soon as possible.
Recommendation
It is recommended to update to Indico 3.2.6. Users who cannot upgrade should restrict category management and content submission privileges to trusted users only.
Other vulnerabilities in Indico
See all- CVE-2026-108388Low
Indico versions 3.3.3 through 3.3.13 incorrectly use the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export, causing speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. The issue was fixed in Indico 3.3.14.
- CVE-2026-107397Medium
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
- CVE-2026-107396Medium
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
- CVE-2026-107395Medium
In Indico prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners.
- CVE-2026-107394Medium
In Indico prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features.
Original NVD description (English source)
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS