{"id":"CVE-2026-107394","published":"2026-10-08T20:17:34.073","lastModified":"2026-10-09T16:17:22.920","description":"Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736","tags":[]},{"url":"https://github.com/indico/indico/pull/7573","tags":[]},{"url":"https://github.com/indico/indico/releases/tag/v3.3.13","tags":[]},{"url":"https://github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9","tags":[]}],"exploitRefs":[{"url":"https://github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736","tags":[]},{"url":"https://github.com/indico/indico/pull/7573","tags":[]},{"url":"https://github.com/indico/indico/releases/tag/v3.3.13","tags":[]},{"url":"https://github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9","tags":[]}],"hasPoc":true,"ai":null}