CVE-2026-107396
Deferred Deferred - Pending Action

Stored XSS in Indico Event Management System

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107396
EUVD
EUVD-2026-95214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
indico indico < 3.3.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-692 The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Indico allows users with event or content management privileges to store malicious JavaScript URLs in custom URL fields. When another user accesses these URLs, the attacker's script executes in the victim's browser within the Indico domain.

Detection Guidance

To detect this vulnerability, inspect event management systems using Flask-Multipass versions prior to 3.3.13. Check for crafted JavaScript URLs in custom URL fields by reviewing event configurations and uploaded materials. No specific commands are provided in the context.

Impact Analysis

If you manage events or upload content in Indico, an attacker could trick you into clicking a malicious link, allowing them to steal your session or perform actions on your behalf. Regular users may also be affected if they interact with crafted URLs.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using Indico may face compliance violations if exploited.

Mitigation Strategies

Upgrade Indico to version 3.3.13 or later to address the vulnerability. Restrict user permissions to prevent unauthorized event or content management. Review and remove any suspicious JavaScript URLs in custom fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart