CVE-2025-59034 – Indico may disclose unauthorized user details access via legacy API

CVE ID : CVE-2025-59034

Published : Sept. 10, 2025, 4:15 p.m. | 23 minutes ago

Description : Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…