CVE-2024-50633: Indico Insecure Access

January 16, 2025 (updated January 21, 2025)

A Broken Object Level Authorization (BOLA) vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals.

References

github.com/advisories/GHSA-3wg7-r7q5-r2jf
github.com/cetinpy/CVE-2024-50633
github.com/cetinpy/CVE-2024-50633/issues/1
github.com/indico/indico
nvd.nist.gov/vuln/detail/CVE-2024-50633

Code Behaviors & Features

Detect and mitigate CVE-2024-50633 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →