CVE-2026-107395: Indico: Missing access check in legacy session export API

October 8, 2026

A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible.

References

github.com/advisories/GHSA-6p4f-j8j6-463q
github.com/indico/indico/commit/524e8e93eadcd8484905b1147020a35f5dce6038
github.com/indico/indico/releases/tag/v3.3.13
github.com/indico/indico/security/advisories/GHSA-6p4f-j8j6-463q
nvd.nist.gov/vuln/detail/CVE-2026-107395

Code Behaviors & Features

Detect and mitigate CVE-2026-107395 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →