CVE-2026-28352

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28352", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T18:38:13.890Z", "datePublished": "2026-02-27T21:01:45.740Z", "dateUpdated": "2026-03-03T20:29:18.718Z"}, "containers": {"cna": {"title": "Indico missing access check in event series management API", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v"}, {"name": "https://github.com/indico/indico/releases/tag/v3.3.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/indico/indico/releases/tag/v3.3.11"}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"version": "< 3.3.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:01:45.740Z"}, "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint."}], "source": {"advisory": "GHSA-rfpp-2hgm-gp5v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T20:29:12.418888Z", "id": "CVE-2026-28352", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:29:18.718Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28352", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:29:12.418888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:29:15.850Z"}}], "cna": {"title": "Indico missing access check in event series management API", "source": {"advisory": "GHSA-rfpp-2hgm-gp5v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"status": "affected", "version": "< 3.3.11"}]}], "references": [{"url": "https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v", "name": "https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/indico/indico/releases/tag/v3.3.11", "name": "https://github.com/indico/indico/releases/tag/v3.3.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:01:45.740Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28352", "state": "PUBLISHED", "dateUpdated": "2026-03-03T20:29:18.718Z", "dateReserved": "2026-02-26T18:38:13.890Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T21:01:45.740Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "indico", "vendor": "indico", "versions": [{"status": "affected", "version": "< 3.3.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cern:indico:*:*:*:*:*:*:*:*", "matchCriteriaId": "85C78415-FE1D-48C2-9C1C-1B12AADFAFAC", "versionEndExcluding": "3.3.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint."}, {"lang": "es", "value": "Indico es un sistema de gesti\u00f3n de eventos que utiliza Flask-Multipass, un sistema de autenticaci\u00f3n multi-backend para Flask. En versiones anteriores a la 3.3.11, el endpoint de la API utilizado para gestionar series de eventos carece de una verificaci\u00f3n de acceso, permitiendo acceso no autenticado/no autorizado a este endpoint. El impacto de esto se limita a obtener los metadatos (t\u00edtulo, cadena de categor\u00eda, fecha de inicio/fin) para eventos en una serie existente, eliminar una serie de eventos existente y modificar una serie de eventos existente. Esta vulnerabilidad NO permite acceso no autorizado a eventos (m\u00e1s all\u00e1 de los metadatos b\u00e1sicos mencionados anteriormente), ni ning\u00fan tipo de manipulaci\u00f3n de datos visibles para el usuario en los eventos. La versi\u00f3n 3.3.11 corrige el problema. Como soluci\u00f3n alternativa, utilice el servidor web para restringir el acceso al endpoint de la API de gesti\u00f3n de series."}], "id": "CVE-2026-28352", "lastModified": "2026-06-17T10:28:27.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28352", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T20:29:12.418888Z", "version": "2.0.3"}}]}, "published": "2026-02-27T21:16:19.323", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/indico/indico/releases/tag/v3.3.11"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "indico", "source": "cna", "vendor": "indico"}, "product": "indico", "vendor": "indico"}], "analysis": {"en": {"generated_at": "2026-04-16T15:15:18.336181+00:00", "value": {"mitigation_remediation": ["Upgrade the Indico installation to version 3.3.11 or later to apply the official patch.", "Configure the web server or API gateway to restrict unauthenticated or insufficiently privileged access to the series\u2011management endpoint, ensuring only authorized users can reach it.", "Verify that the restriction is effective by attempting to access the endpoint with a non\u2011privileged account and confirming that the request is denied."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized metadata exposure and deletion of event series"}, "threat_synthesis": {"affected_systems": "Any Indico deployment running a version earlier than 3.3.11 is affected. The fix was introduced in release 3.3.11 and later. Version 3.3.11 and newer eliminate the missing access check, restoring proper authorization controls for all series\u2011management actions.", "description_and_impact": "Indico, an event management platform built on Flask, omitted an access check on the API endpoint that manages event series. This flaw lets an unauthenticated or unauthorized user read the series title, category chain, and dates; delete an entire series; or modify its details. The attack is limited to manipulating series structure and no direct access to the events themselves or tampering with user\u2011visible event data. The weakness is a classic case of missing authentication for privileged operations (CWE-306).", "risk_and_exploitability": "The CVSS score of 6.5 categorises the vulnerability as moderate, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. It is not listed in CISA\u2019s KEV catalog, suggesting that large\u2011scale, widespread attacks are not documented. The likely attack path involves an attacker sending HTTP requests to the series\u2011management endpoint when it is publicly reachable; no additional credentials are required. Consequently, the risk is primarily to data integrity and availability for the event series themselves, with limited impact on individual event content."}}}}, "created": "2026-03-02T12:04:53.076008+00:00", "updated": "2026-04-16T15:15:39.052341+00:00", "vendors": ["indico", "indico$PRODUCT$indico"]}