Flask
CVE-2026-28352
MEDIUM
GHSA-rfpp-2hgm-gp5v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.
AnalysisAI
Missing authentication checks on Indico's event series management API endpoint allows unauthenticated attackers to view event metadata, delete series, and modify series configurations. The vulnerability affects Indico versions prior to 3.3.11 and has limited impact as it does not grant access to actual event data beyond basic metadata. Upgrade to version 3.3.11 or restrict API endpoint access at the web server level to remediate.
Technical ContextAI
Classified as CWE-306 (Missing Authentication for Critical Function). Affects Indico. Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Path traversal and extension bypass in Flask-Reuploaded file upload library. Allows uploading files with arbitrary exten
Reflected XSS in changedetection.io versions prior to 0.54.4 allows unauthenticated remote attackers to inject malicious
changedetection.io versions before 0.54.1 are vulnerable to reflected cross-site scripting (XSS) via the RSS endpoint, w
Changedetection.io versions before 0.53.2 allow unauthenticated attackers to read arbitrary files from the application d
Flask is a lightweight WSGI web application framework. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. Rated high severity (CVSS 7.5), this vulne
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that
The Flask Micro code-editor plugin for WordPress through version 1.0.0 contains a stored cross-site scripting vulnerabil
Cross-site scripting in Indico prior to version 3.3.10 allows authenticated users to inject malicious scripts through ma
Indico versions before 3.3.10 allow authenticated event organizers to conduct server-side request forgery attacks by pro
Flask versions 3.1.2 and earlier fail to set proper cache headers when the session object is accessed through certain me
Share
External POC / Exploit Code
Leaving vuln.today