要点
- CVE-2026-107395 は indico に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.24%（全脆弱性の 14.4% より高い）。
- 対処：3.3.13 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| indico PyPI | < 3.3.13
| 3.3.13
|
概要
Impact
A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible.
Patches
You should to update to Indico 3.3.13 as soon as possible.
See the docs for instructions on how to update.
Workarounds
Restrict access to the event itself
For more information
If you have any questions or comments about this advisory:
NVD の説明
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing event is accessible. The missing access check can disclose session metadata such as the title, description, and conveners. This issue is fixed in version 3.3.13.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン