Executive Summary

CVE-2026-28352 is a vulnerability in the Indico event management system affecting versions prior to 3.3.11. It arises because the API endpoint used to manage event series lacks an access check, allowing unauthenticated and unauthorized users to access it.

This flaw lets attackers retrieve metadata about events in a series, such as titles, category chains, and start/end dates. They can also delete or modify event series metadata, like toggling metadata display or setting event title patterns. However, it does not allow access to the actual event content or tampering with user-visible event data.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing unauthorized users to access and manipulate event series metadata without authentication.

• Unauthorized retrieval of event series metadata such as titles, category chains, and event dates.
• Deletion of an existing event series, which removes series metadata including links between events and lecture series numbers.
• Modification of event series metadata, including toggling metadata display and setting event title patterns.

Despite these impacts, the vulnerability does not allow unauthorized access to the actual event content or tampering with user-visible event data, limiting the overall severity.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-28352 in Indico, the primary step is to update Indico to version 3.3.11, which includes the fix for the missing access check in the event series management API endpoint.

As a workaround before updating, you can restrict access to the series management API endpoint at the webserver level to prevent unauthorized access.

Useful 0 Not Useful 0