CVE-2025-53640
Indico vulnerable to user enumeration via API endpoint
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 4.0 | Medium5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| NVDNVD · Analyzed | 4.0 | Medium5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.66% · top 48% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
- CWE-639: Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs
- CWE-862: Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIindicoGHSA-q28v-664f-q6wj (opens in a new tab)
References (6)
- https://github.com/indico/indico/security/advisories/GHSA-q28v-664f-q6wj (opens in a new tab)x_refsource_CONFIRM
- https://docs.getindico.io/en/stable/config/settings/#ALLOW_PUBLIC_USER_SEARCH (opens in a new tab)x_refsource_MISC
- https://docs.getindico.io/en/stable/installation/upgrade (opens in a new tab)x_refsource_MISC
- https://github.com/indico/indico/releases/tag/v3.3.7 (opens in a new tab)x_refsource_MISC
- https://www.vicarius.io/vsociety/posts/cve202553640-detect-indico-vulnerability (opens in a new tab)
- https://www.vicarius.io/vsociety/posts/cve202553640-mitigate-indico-vulnerability (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-q28v-664f-q6wj (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-53640)Record last updated .