CVE-2026-28352: 
Python vulnerability analysis and mitigation

CVE-2026-28352 is a missing access control vulnerability in Indico, an open-source event management system developed by CERN that uses Flask-Multipass for authentication. The flaw affects all Indico versions prior to 3.3.11 and was disclosed on February 27, 2026, by maintainer ThiefMaster via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.5 (Medium/Moderate), reflecting its network-accessible, unauthenticated attack vector with limited confidentiality and integrity impact (Github Advisory, Indico Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the API endpoint responsible for managing event series performs no authentication or authorization checks before processing requests. An unauthenticated remote attacker can send HTTP requests directly to this endpoint without any credentials or session tokens. The vulnerable functionality includes reading event series metadata, deleting series (removing inter-event links and lecture series numbering), and modifying series properties such as metadata display toggles and event title patterns used during cloning. The fix in v3.3.11 adds a requirement that the caller must have management access to all events in a series before any series management operation is permitted (Indico Advisory, v3.3.11 Release).

Successful exploitation allows an unauthenticated attacker to retrieve event series metadata — including titles, category chains, and start/end dates — for events that may otherwise be access-restricted, potentially disclosing information about non-public events. Attackers can also delete event series, disrupting the organizational structure of events (removing inter-event links and series numbering), or modify series properties such as title patterns. The vulnerability explicitly does not permit full access to protected event content, attendee data, or user-visible event tampering, limiting its overall severity (Github Advisory, Indico Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible Indico instances running versions prior to 3.3.11 using web search, Shodan, or Censys, targeting the Indico pip package.
2. Locate the series management API endpoint: Identify the unauthenticated API endpoint used for event series management (e.g., /api/series/<series_id> or equivalent REST endpoint exposed by Indico).
3. Read series metadata: Send an unauthenticated HTTP GET request to the series endpoint to retrieve event metadata (title, category chain, start/end date) for events in the series, including potentially access-restricted events.
4. Delete or modify a series: Send an unauthenticated HTTP DELETE or PATCH/PUT request to the same endpoint to remove the series or alter its properties (e.g., toggle metadata display, set event title patterns), without providing any authentication credentials.
5. Achieve objective: Depending on intent, the attacker has now either exfiltrated metadata about restricted events or disrupted event series organization for legitimate users (Indico Advisory, v3.3.11 Release).

• Network: Unauthenticated HTTP GET, DELETE, or PATCH/PUT requests to the Indico event series management API endpoint (e.g., /api/series/<id>) originating from unexpected or external IP addresses.
• Logs: Web server access logs showing requests to the series API endpoint with no associated session cookie or authentication token, particularly from IPs not associated with known administrators or event managers.
• Logs: Repeated or automated requests to series endpoints in short time windows, suggesting enumeration of series IDs.
• Application: Unexpected deletion or modification of event series records in the Indico database without a corresponding authenticated user action in audit logs.

Upgrade Indico to version 3.3.11 or later, which adds proper access checks requiring management rights over all events in a series before any series management operation is allowed (v3.3.11 Release). As a temporary workaround prior to patching, configure the web server (e.g., Apache or Nginx) to restrict access to the series management API endpoint to authorized IP ranges or authenticated users only (Indico Advisory). Monitoring API access logs for anomalous unauthenticated requests to series endpoints is also recommended during the remediation window.

The advisory was published by Indico maintainer ThiefMaster on February 27, 2026, with credit given to researcher @lighthousekeeper1212 for discovering and reporting the issue. The release notes note that while unauthorized changes to event series were possible, "the impact is rather low, since this cannot be used to tamper with events or deface them in any way" (v3.3.11 Release). No significant broader media coverage or notable community controversy has been observed.