Indico CVE-2026-108388

Exploitation requires an authenticated low-privileged account on the target Indico instance (PR:L) AND successful social engineering of a privileged user into requesting a crafted LEGACY contribution export (UI:R) - the vulnerable path is the legacy contribution-export API whose cached response is keyed such that a lower-privileged user can later read it. Affected versions are Indico 3.3.3 through 3.3.13. Limiting factors: it is NOT remote-unauthenticated (attacker must hold a valid session), it depends on the privileged victim actively performing the induced export action, and the leaked data is limited to speaker/author email addresses and contribution ACL entries (no integrity or availability impact, no full-privilege management access). Instances on 3.3.14 or later, or those not exposing the legacy export flow to low-privileged users, are not exploitable.

This is a genuinely low-priority vulnerability, and the signals are consistent in pointing that way. The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N, base 3.5) describes a network-reachable but authenticated issue (PR:L) that requires user interaction from a privileged victim (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. CWE-863 (Incorrect Authorization) correctly frames this as a broken access-control check - Contribution.can_manage evaluates the ambient session user rather than the supplied user - rather than a direct authentication bypass. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or automated weaponization; the exploit path also depends on social-engineering a privileged user into requesting a crafted legacy export and on specific API-cache behavior, which further limits real-world impact. The leaked data (speaker/author email addresses and ACL entries) is sensitive but not high-value credential or RCE material. Net: a legitimate but low-severity information-disclosure flaw that should be patched during normal maintenance, not an emergency. One caveat worth verifying: the input Tag 'Authentication Bypass' does not match CWE-863 (an authorization flaw), so do not treat this as an auth-bypass per the tag alone.

A low-privileged but authenticated Indico user crafts a legacy contribution-export request and induces a privileged event manager to open it (e.g., via a shared link). Because the permission check evaluates the privileged victim's session instead of the requesting user, speaker/author email addresses and contribution ACL entries get stored in an API cache entry that the low-privileged attacker can then retrieve. No public exploit code was identified at time of analysis.