{"schema":"threatline.record/2","record":{"id":"CVE-2026-107395","aliases":["GHSA-6p4f-j8j6-463q","PYSEC-2026-4226"],"summary":"Indico: Missing access check in legacy session export API","details":"### Impact\nA legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible.\n\n### Patches\nYou should to update to [Indico 3.3.13](https://github.com/indico/indico/releases/tag/v3.3.13) as soon as possible.\nSee [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.\n\n### Workarounds\nRestrict access to the event itself\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open a thread in [our forum](https://talk.getindico.io/)\n- Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)","categories":["Libraries & packages"],"product":"indico","vendor":"indico","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6p4f-j8j6-463q","source_modified_at":"2026-10-08T22:09:51Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"indico"},"range":"< 3.3.13"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107395","source_modified_at":"2026-10-09T11:49:03.687Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"indico","vendor":"indico","versions":[{"version":"< 3.3.13","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6p4f-j8j6-463q","source_modified_at":"2026-10-15T14:55:57.961569407Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"indico","purl":"pkg:pypi/indico"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.3.13"}],"type":"ECOSYSTEM"}],"versions":["0.98-rc1","0.98.0","0.98.1","0.98.2","0.99","1.0","1.1","1.1.1","1.1.2","1.2","1.2.1","1.2.1rc10","1.2.1rc11","1.2.1rc2","1.2.1rc4","1.2.1rc5","1.2.1rc6","1.2.1rc7","1.2.1rc9","1.2.2","1.2.2rc1","1.9.11.dev10","1.9.11.dev11","1.9.11.dev12","1.9.11.dev13","1.9.11.dev14","1.9.11.dev15","1.9.11.dev16","1.9.11.dev17","1.9.11.dev3","1.9.11.dev4","1.9.11.dev6","1.9.11.dev7","1.9.11.dev8","1.9.11.dev9","2.0","2.0.1","2.0.2","2.0.3","2.0a1","2.0rc1","2.0rc2","2.1","2.1.1","2.1.10","2.1.11","2.1.2","2.1.3","2.1.4","2.1.5"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6p4f-j8j6-463q","source_modified_at":"2026-10-08T22:09:51Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"indico"},"version":"3.3.13"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6p4f-j8j6-463q","source_modified_at":"2026-10-15T14:55:57.961569407Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"indico","purl":"pkg:pypi/indico"},"version":"3.3.13"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00235,"percentile":0.13578,"score_date":"2026-10-23"},"published_at":"2026-10-08T19:57:39.353Z","modified_at":"2026-10-15T14:55:57.961569407Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-6p4f-j8j6-463q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T22:09:51Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107395","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-09T11:49:03.687Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-6p4f-j8j6-463q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T14:55:57.961569407Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107395","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/indico/indico/security/advisories/GHSA-6p4f-j8j6-463q","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107395","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/indico/indico/commit/524e8e93eadcd8484905b1147020a35f5dce6038","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/indico/indico/releases/tag/v3.3.13","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-6p4f-j8j6-463q","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-09T11:48:53.899951Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:55:57.961569407Z","content_hash":"2e77d6127a8170aab510c0d35b09fc408e45bb76d798aa5f00896e865a93090a"}}