CVE-2024-50633 Indico Insecure Access
Attackers can read user account information via crafted API requests, though the vendor disputes this as intended functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50633?
CVE-2024-50633 is a vulnerability in CERN Indico, published on 16 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
Weakness: CWE-201
Which versions are affected by CVE-2024-50633?
3 open source packages ship an affected version, including indico. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
indico PyPI | From 3.2.9 | 3.3.3 |
indico PyPI | From 3.2.9 | 3.3.3 |
indico PyPI | From 3.2.9 | 3.3.3 |
Products include Cern Indico.
How do I fix CVE-2024-50633?
Upgrade indico to 3.3.3 or later.
Is CVE-2024-50633 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50633 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in CERN Indico
- CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
- CVE-2021-30185 Indico Tampering with links (e.g. password reset) in sent emails
- CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
- CVE-2026-28352 Indico missing access check in event series management API
- CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
Sources
Also known as GHSA-3wg7-r7q5-r2jf, PYSEC-2026-1459.