CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API

What is CVE-2025-59034?

CVE-2025-59034 is a medium-severity missing authorization vulnerability in indico, published on 10 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

Weakness: CWE-639

Which versions are affected by CVE-2025-59034?

3 open source packages ship an affected version, including indico. It affects 1 product.

Products include Cern Indico.

How do I fix CVE-2025-59034?

Upgrade indico to 3.3.8 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-59034 being exploited?

There is no known exploitation of CVE-2025-59034 in the wild and no public exploit code.

Other vulnerabilities in indico

• CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection High 7.7
• CVE-2021-30185 Indico Tampering with links (e.g. password reset) in sent emails High 7.5
• CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places Medium 6.9
• CVE-2026-28352 Indico missing access check in event series management API Medium 6.5
• CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4269-mcfh-cp7q, PYSEC-2026-1460.