CVE-2025-59034CWE-639

Indico may disclose unauthorized user details access via legacy API

Medium · published September 10, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-09-10T16:01Z
EPSS history
Timeline
  • 10 SEP 16:01Z
    Indico may disclose unauthorized user details access via legacy API
    cvelistv5