Indico CVE-2026-107397

Exploitation requires an authenticated account with privileges to create/edit event minutes (content creator or speaker able to create minutes) to store the crafted HTML payload. The payload only executes when a second privileged user performs CONCURRENT edits to the SAME minutes, triggering the minute-editor conflict-resolution UI that renders the unsanitized HTML - this specific concurrent-edit conflict path is the required deployment/feature condition. Limiting factors: both attacker and victim must hold edit rights on the identical minutes object (per vendor note), the victim must interact by opening the conflicting edit, and the collaboration-dependent timing makes opportunistic/mass exploitation impractical (reflected as AC:H). This is not exploitable against default configurations by an unauthenticated remote attacker.

This is a genuinely low-priority issue despite being a stored XSS (CWE-79). The CVSS 3.1 base score of 4.4 (Medium) is driven down by three limiting metrics in the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N: high attack complexity (AC:H), required low privileges (PR:L), and required user interaction (UI:R). The scope change (S:C) and network vector (AV:N) are the only aggravating factors, reflecting that injected script executes in the trusted Indico origin. No EPSS score was provided, so statistical exploitation probability cannot be weighed. There is no CISA KEV listing and no public exploit (POC) in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' Crucially, the AC:H rating is corroborated by the vendor's own advisory note, which states the attacker and victim must both have edit privileges on the SAME minutes and collaborate via concurrent edits to trigger the conflict-resolution UI - a narrow, collusion-like precondition rather than a drive-by attack. All signals are consistent: moderate CVSS, no active exploitation, no POC, and vendor-confirmed low risk. This is a legitimate defense-in-depth fix, not an urgent patch-now emergency; prioritize via normal maintenance cycles.

A low-privileged user who can create content (e.g., a speaker permitted to author minutes) stores crafted HTML containing a script payload in event minutes. When a second privileged user edits the same minutes concurrently, the minute-editor conflict-resolution UI renders the attacker's unsanitized HTML, executing attacker-controlled JavaScript in the viewer's browser within the Indico origin (enabling session/CSRF-token theft or actions as the victim). No public POC is identified, and the high complexity requires both parties to be editing the same minutes.