CVE-2026-25738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25738", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T16:48:00.428Z", "datePublished": "2026-02-19T15:30:54.824Z", "dateUpdated": "2026-02-19T17:34:39.413Z"}, "containers": {"cna": {"title": "Indico has Server-Side Request Forgery (SSRF) in multiple places", "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4"}, {"name": "https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137", "tags": ["x_refsource_MISC"], "url": "https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137"}, {"name": "https://github.com/indico/indico/releases/tag/v3.3.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/indico/indico/releases/tag/v3.3.10"}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"version": "< 3.3.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:30:54.824Z"}, "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality but is never intended to let users access \"special\" targets such as localhost or cloud metadata endpoints. Users should upgrade to version 3.3.10 to receive a patch. Those who do not have IPs that expose sensitive data without authentication (typically because they do not host Indico on AWS) are not affected. Only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. For those who trust their event organizers, the risk is also very limited. For additional security, both before and after patching, one may also use the common proxy-related environment variables (in particular `http_proxy` and `https_proxy`) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery services."}], "source": {"advisory": "GHSA-f47c-3c5w-v7p4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:22:45.376010Z", "id": "CVE-2026-25738", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:34:39.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:22:45.376010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:22:47.267Z"}}], "cna": {"title": "Indico has Server-Side Request Forgery (SSRF) in multiple places", "source": {"advisory": "GHSA-f47c-3c5w-v7p4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"status": "affected", "version": "< 3.3.10"}]}], "references": [{"url": "https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4", "name": "https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137", "name": "https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/indico/indico/releases/tag/v3.3.10", "name": "https://github.com/indico/indico/releases/tag/v3.3.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality but is never intended to let users access \"special\" targets such as localhost or cloud metadata endpoints. Users should upgrade to version 3.3.10 to receive a patch. Those who do not have IPs that expose sensitive data without authentication (typically because they do not host Indico on AWS) are not affected. Only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. For those who trust their event organizers, the risk is also very limited. For additional security, both before and after patching, one may also use the common proxy-related environment variables (in particular `http_proxy` and `https_proxy`) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:30:54.824Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25738", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:34:39.413Z", "dateReserved": "2026-02-05T16:48:00.428Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T15:30:54.824Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "indico", "vendor": "indico", "versions": [{"status": "affected", "version": "< 3.3.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cern:indico:*:*:*:*:*:*:*:*", "matchCriteriaId": "386CCD17-7701-42CD-83A1-FEE910FDBBB3", "versionEndExcluding": "3.3.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality but is never intended to let users access \"special\" targets such as localhost or cloud metadata endpoints. Users should upgrade to version 3.3.10 to receive a patch. Those who do not have IPs that expose sensitive data without authentication (typically because they do not host Indico on AWS) are not affected. Only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. For those who trust their event organizers, the risk is also very limited. For additional security, both before and after patching, one may also use the common proxy-related environment variables (in particular `http_proxy` and `https_proxy`) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery services."}, {"lang": "es", "value": "Indico es un sistema de gesti\u00f3n de eventos que utiliza Flask-Multipass, un sistema de autenticaci\u00f3n multi-backend para Flask. Las versiones anteriores a la 3.3.10 son vulnerables a la falsificaci\u00f3n de petici\u00f3n del lado del servidor. Indico realiza peticiones salientes a URLs proporcionadas por el usuario en varios lugares. Esto es en su mayor\u00eda intencional y parte de la funcionalidad de Indico, pero nunca se pretende que los usuarios accedan a objetivos 'especiales' como localhost o puntos finales de metadatos en la nube. Los usuarios deben actualizar a la versi\u00f3n 3.3.10 para recibir un parche. Aquellos que no tienen IPs que exponen datos sensibles sin autenticaci\u00f3n (t\u00edpicamente porque no alojan Indico en AWS) no se ven afectados. Solo los organizadores de eventos pueden acceder a los puntos finales donde se podr\u00eda usar SSRF para ver realmente los datos devueltos por dicha petici\u00f3n. Para aquellos que conf\u00edan en sus organizadores de eventos, el riesgo tambi\u00e9n es muy limitado. Para seguridad adicional, tanto antes como despu\u00e9s de aplicar el parche, tambi\u00e9n se pueden usar las variables de entorno comunes relacionadas con el proxy (en particular `http_proxy` y `https_proxy`) para forzar que las peticiones salientes pasen por un proxy que limite las peticiones de la manera que se considere \u00fatil/necesaria. Estas variables de entorno deber\u00edan configurarse tanto en los servicios indico-uwsgi como indico-celery."}], "id": "CVE-2026-25738", "lastModified": "2026-06-17T10:25:08.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25738", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:22:45.376010Z", "version": "2.0.3"}}]}, "published": "2026-02-19T16:27:15.093", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/indico/indico/releases/tag/v3.3.10"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "indico", "source": "cna", "vendor": "indico"}, "product": "indico", "vendor": "indico"}], "analysis": {"en": {"generated_at": "2026-04-18T11:47:40.717043+00:00", "value": {"mitigation_remediation": ["Upgrade Indico to version 3.3.10 or later to eliminate the SSRF flaw.", "If an upgrade is infeasible, set the http_proxy and https_proxy environment variables on both the indico-uwsgi and indico-celery services so that outbound requests are routed through a controlled proxy that can restrict destinations.", "Enforce least privilege for event organizers to mitigate the trust boundary issue (CWE\u2011367) and monitor outbound requests to detect misuse related to the SSRF vulnerability (CWE\u2011918)."], "summary": {"action": "Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the Indico event management system, supplied by indico:indico. Versions before 3.3.10 contain the flaw; the vendor released version 3.3.10 with a patch that prevents requests to protected endpoints. Only installations running these older releases are vulnerable.", "description_and_impact": "Indico allows users to supply arbitrary URLs that are requested by the application, creating a server\u2011side request forgery weakness (CWE\u2011918) where an authenticated event organizer can construct requests to internal addresses such as localhost or cloud metadata services and read any data returned, thereby potentially exposing sensitive system information or leaking credentials. The flaw also reflects a broken trust boundary (CWE\u2011367) that lets organizers influence outbound traffic that the system is not intended to expose. The impact is limited to confidentiality and may affect availability if repeated requests breach rate limits.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity, but the EPSS estimate of less than 1% shows the probability of exploitation is low. The flaw is not listed in the CISA KEV catalog. The attack requires that the attacker is an event organizer and can forge a URL. Typical deployments that do not expose internal resources through the public interface are thus loosely affected, and risk is further limited to organizers that are trusted by the organization."}}}}, "created": "2026-02-20T10:06:28.230152+00:00", "updated": "2026-04-18T12:00:05.875683+00:00", "vendors": ["indico", "indico$PRODUCT$indico"]}