Indico EUVD-2026-95212

Exploitation requires an authenticated account with event-organizer privileges on the Indico instance (PR:H) and use of an affected Indico feature that fetches an organizer-supplied URL. The specific trigger is a crafted URL containing a backslash that defeats Indico's local-target filter (demonstrated by 'http://127.0.0.1\@1.1.1.1'), an edge case left uncovered by the prior CVE-2026-25738 fix. Limiting factors: the attacker must already hold the trusted organizer role (no anonymous or low-privilege path), the instance must run Indico prior to 3.3.13, and value depends on reachable internal targets behind the Indico server; no end-user interaction is required.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N = 6.8 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring PR:H - the attacker must already hold event-organizer privileges, a trusted elevated role, which substantially shrinks the threat population to insiders or compromised organizer accounts. The scope change (S:C) and C:H reflect that a successful SSRF lets the organizer pivot Indico's server to read data from internal/prohibited targets it should not reach. No EPSS score, KEV listing, POC, or SSVC data was provided in the input; per precision rules this is 'no public exploit identified at time of analysis.' The GitHub source evidence is the vendor fix (a one-line backslash check), not weaponized exploit code, so POC availability is NOT established. The dominant limiting factor is the PR:H requirement plus the fact that this is an incremental bypass of the earlier CVE-2026-25738 fix for a narrow edge case, which favors targeted insider abuse over mass exploitation. Net: prioritize patching for internet-facing or multi-tenant Indico instances with untrusted organizers, but it does not warrant drop-everything urgency.

A user holding event-organizer rights on an Indico instance configures an affected feature (e.g., a URL-based integration) with a crafted URL such as 'http://127.0.0.1\@1.1.1.1' that bypasses Indico's SSRF filter and points at a prohibited internal target. Indico's server fetches the target and returns its response data to the organizer, exposing internal services or metadata. No public exploit code was provided in the input, though the bypass primitive is documented in the vendor's fix and test case.