{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-08T09:19:14.420","vulnerabilities":[{"cve":{"id":"CVE-2026-25738","sourceIdentifier":"security-advisories@github.com","published":"2026-02-19T16:27:15.093","lastModified":"2026-02-26T02:57:25.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality but is never intended to let users access \"special\" targets such as localhost or cloud metadata endpoints. Users should upgrade to version 3.3.10 to receive a patch. Those who do not have IPs that expose sensitive data without authentication (typically because they do not host Indico on AWS) are not affected. Only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. For those who trust their event organizers, the risk is also very limited. For additional security, both before and after patching, one may also use the common proxy-related environment variables (in particular `http_proxy` and `https_proxy`) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery services."},{"lang":"es","value":"Indico es un sistema de gestión de eventos que utiliza Flask-Multipass, un sistema de autenticación multi-backend para Flask. Las versiones anteriores a la 3.3.10 son vulnerables a la falsificación de petición del lado del servidor. Indico realiza peticiones salientes a URLs proporcionadas por el usuario en varios lugares. Esto es en su mayoría intencional y parte de la funcionalidad de Indico, pero nunca se pretende que los usuarios accedan a objetivos 'especiales' como localhost o puntos finales de metadatos en la nube. Los usuarios deben actualizar a la versión 3.3.10 para recibir un parche. Aquellos que no tienen IPs que exponen datos sensibles sin autenticación (típicamente porque no alojan Indico en AWS) no se ven afectados. Solo los organizadores de eventos pueden acceder a los puntos finales donde se podría usar SSRF para ver realmente los datos devueltos por dicha petición. Para aquellos que confían en sus organizadores de eventos, el riesgo también es muy limitado. Para seguridad adicional, tanto antes como después de aplicar el parche, también se pueden usar las variables de entorno comunes relacionadas con el proxy (en particular `http_proxy` y `https_proxy`) para forzar que las peticiones salientes pasen por un proxy que limite las peticiones de la manera que se considere útil/necesaria. Estas variables de entorno deberían configurarse tanto en los servicios indico-uwsgi como indico-celery."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cern:indico:*:*:*:*:*:*:*:*","versionEndExcluding":"3.3.10","matchCriteriaId":"386CCD17-7701-42CD-83A1-FEE910FDBBB3"}]}]}],"references":[{"url":"https://github.com/indico/indico/commit/70d341826116fac5868719a6133f2c26d9345137","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/indico/indico/releases/tag/v3.3.10","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/indico/indico/security/advisories/GHSA-f47c-3c5w-v7p4","source":"security-advisories@github.com","tags":["Vendor Advisory","Mitigation"]}]}}]}