CVE-2026-28352 Indico missing access check in event series management API
Unauthenticated attackers can read, modify, or delete event series metadata in Indico due to a missing access check in the API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28352?
CVE-2026-28352 is a medium-severity missing authorization vulnerability in indico, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.
Weakness: CWE-306
Which versions are affected by CVE-2026-28352?
3 open source packages ship an affected version, including indico. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
indico PyPI | All versions | 3.3.11 |
indico PyPI | All versions | 3.3.11 |
indico PyPI | All versions | 3.3.11 |
Products include Cern Indico.
How do I fix CVE-2026-28352?
Upgrade indico to 3.3.11 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-28352 being exploited?
There is no known exploitation of CVE-2026-28352 in the wild and no public exploit code.
Other vulnerabilities in indico
- CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
- CVE-2021-30185 Indico Tampering with links (e.g. password reset) in sent emails
- CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
- CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
- CVE-2023-37901 Cross-Site-Scripting via confirmation prompts
Sources
Also known as GHSA-rfpp-2hgm-gp5v, PYSEC-2026-2183.