Indico CVE-2026-107395

Exploitation requires an authenticated Indico account (PR:L) and the ability to access the event that contains the target session; the attacker then invokes the legacy session export API, which failed to call session.can_access() per session. Limiting factors: the attacker must already have valid credentials and legitimate access to the parent event, only restricted sessions whose containing event is accessible are exposed, and the leak is confined to read-only metadata (title, description, conveners) with no integrity or availability impact. Affected deployments are Indico prior to 3.3.13; upgrading to 3.3.13 adds the missing check.

This is a genuine but low-priority information-disclosure issue, and the available signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) accurately reflects the description: network-reachable, low-complexity, but requiring an authenticated account (PR:L) and yielding only low confidentiality impact with no integrity or availability effect. CWE-862 (Missing Authorization) matches the root cause - a missing can_access() check in the sessions export API. No EPSS score, KEV listing, or POC was provided; the only exploitation signal is confirmation that neither active exploitation nor public exploit code is indicated in the input. The GitHub security advisory (GHSA-6p4f-j8j6-463q), the fixing commit, and the v3.3.13 release are all present, so the fix is well documented. Net: a real authorization-bypass bug worth patching on a normal cadence, but not an emergency - impact is limited to disclosure of session metadata (title, description, conveners), it requires valid credentials, and there is no indication of exploitation. Note the 'Authentication Bypass' tag is imprecise: per CWE-862 and the description this is an authorization/access-control failure, not authentication bypass.

An authenticated Indico user who can view a public event but is not permitted to see a restricted session within it calls the legacy session export API for that event. Because the endpoint omits a per-session access check, the response leaks the restricted session's metadata (title, description, conveners). No public exploit code is identified at time of analysis, though the one-line fixing commit makes the flaw trivial to reproduce.