Indico CVE-2026-107396

Exploitation requires an authenticated account with at least submitter, speaker (material upload), or event-management privileges, and the ability to enter a custom URL in an affected field - specifically attachment link URLs (indico/modules/attachments/forms.py), event layout/menu links (events/layout/forms.py), and event note/minutes HTML (events/notes/schemas.py). The attacker stores a javascript: scheme URL (or unsanitized HTML), and a second condition is victim interaction: another user must click the crafted link for the script to run in the Indico origin. Limiting factors: this is not remotely unauthenticated (privileged event role needed), it depends on social-engineering the victim into clicking, and for the minutes/notes variant both attacker and victim must share edit privileges on the same minutes, further narrowing realistic abuse. Fixed in Indico 3.3.13.

This is a stored/DOM cross-site-scripting issue (CWE-692, incomplete denylist for javascript: URLs) with a vendor-assigned CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which is consistent with the description: the network attack vector reflects a web application, but PR:L confirms the attacker must already hold at least submitter/content-creator or event-management privileges, and UI:R confirms the victim must click the malicious link. The S:C (scope change) and C:L/I:L capture that injected script runs in the Indico origin against other users' sessions. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the only 'source code evidence' supplied is the upstream patch diff (PR #7619), not a weaponized POC. The vendor (CERN/Indico) itself rates the real-world risk as low, noting the attacker needs privileged event access plus victim interaction. Net: this is a legitimately low-to-moderate, privilege-and-interaction-gated XSS, not a drop-everything priority; the high-sounding network vector is tempered by the authentication and user-interaction requirements. All signals are mutually consistent; the main missing data points are EPSS probability and any independent exploitation telemetry.

An attacker with submitter, speaker, or event-management rights edits an attachment link, menu entry, or event note/minutes and stores a javascript: URL in a field that accepts custom URLs. When another Indico user (e.g., a conference participant or co-organizer) clicks that link, the attacker-controlled script executes in the victim's browser within the Indico origin, enabling session/cookie theft or actions as the victim. No public exploit code was identified; only the upstream fix commit is available.