CVE-2026-108388 indico CVE debrief

Who should care

Defenders responsible for Indico applications, particularly those with low-privileged users, should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to understand the potential impact of this vulnerability on their systems and take appropriate actions to mitigate the risk.

Why it matters

CVE-2026-108388 is a low-severity vulnerability in Indico that allows low-privileged users to induce privileged users to request crafted legacy contribution exports, potentially disclosing restricted metadata. Defenders should prioritize verifying exposure and assessing the impact on their systems.

• Defenders should verify exposure to potential cache poisoning attacks
• Low-privileged users may be able to access restricted metadata
• Defenders should assess the impact of this vulnerability on their systems
• Remediation priority is low to medium due to the limited impact of the vulnerability

Technical summary

The Indico application incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. This allows a low-privileged user to induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly in environments where low-privileged users have access to the Indico application.

Recommended defensive actions

• Verify that the Indico application is running version 3.3.14 or later
• Assess the exposure of low-privileged users to the Indico application
• Monitor for potential abuse of the legacy contribution export feature
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.