Auth bypass in Cern Indico
CVE-2026-28352
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (26.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Cern Indico
- Indico — versions < 3.3.11
Weakness classification (CWE)
References
- github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v (Patch, Mitigation, Vendor Advisory)
- github.com/indico/indico/releases/tag/v3.3.11 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-28352?
- CVE-2026-28352 is a medium-severity vulnerability in Cern Indico, classified under Missing Authentication for Critical Function. CVSS score: 6.5/10. Published 2026-02-27.
- How severe is CVE-2026-28352?
- Medium severity. CVSS v3 base score is 6.5 out of 10.