CVE-2026-28352
Unauthorized Access in Indico Event Series API Prior to
Publication date: 2026-02-27
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cern | indico | to 3.3.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28352 is a vulnerability in the Indico event management system affecting versions prior to 3.3.11. It arises because the API endpoint used to manage event series lacks an access check, allowing unauthenticated and unauthorized users to access it.
This flaw lets attackers retrieve metadata about events in a series, such as titles, category chains, and start/end dates. They can also delete or modify event series metadata, like toggling metadata display or setting event title patterns. However, it does not allow access to the actual event content or tampering with user-visible event data.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing unauthorized users to access and manipulate event series metadata without authentication.
- Unauthorized retrieval of event series metadata such as titles, category chains, and event dates.
- Deletion of an existing event series, which removes series metadata including links between events and lecture series numbers.
- Modification of event series metadata, including toggling metadata display and setting event title patterns.
Despite these impacts, the vulnerability does not allow unauthorized access to the actual event content or tampering with user-visible event data, limiting the overall severity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-28352 in Indico, the primary step is to update Indico to version 3.3.11, which includes the fix for the missing access check in the event series management API endpoint.
As a workaround before updating, you can restrict access to the series management API endpoint at the webserver level to prevent unauthorized access.