6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28352

CVE-2026-28352: Indico missing access check in event series management API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an existing event series, and modifying an existing event series. This vulnerability does NOT allow unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to restrict access to the series management API endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28352

CVE-2026-28352:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
indico	pip	< 3.3.11	3.3.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing access check in the event series management API. The root cause was that the RHEventSeries class, which handles all API requests for event series (/event-series/), inherited from the RH base class. This base class does not perform any authentication or authorization checks, thus exposing the API endpoints to unauthenticated users. The patch fixes this by changing the parent class to RHProtected, which enforces user authentication, and by adding a _check_access method to the RHEventSeries class. This new method ensures that the authenticated user has management permissions for all events within the series before allowing any action. The vulnerable functions are the HTTP method handlers (_process_GET, _process_PATCH, _process_POST, _process_DELETE) within the RHEventSeries class, as they were the entry points for the unauthorized actions.

Vulnerable functions

RHEventSeries._process_GET

indico/modules/events/series/controllers.py

This function, responsible for handling GET requests for event series, was vulnerable because its parent class `RHEventSeries` inherited from `RH`, which does not enforce authentication or authorization. This allowed any unauthenticated user to retrieve metadata of event series.

RHEventSeries._process_PATCH

indico/modules/events/series/controllers.py

This function, responsible for handling PATCH requests to modify event series, was vulnerable because its parent class `RHEventSeries` inherited from `RH`, which does not enforce authentication or authorization. This allowed any unauthenticated user to modify the metadata of event series.

RHEventSeries._process_POST

indico/modules/events/series/controllers.py

This function, responsible for handling POST requests to create event series, was vulnerable because its parent class `RHEventSeries` inherited from `RH`, which does not enforce authentication or authorization. This allowed any unauthenticated user to create new event series, although they would need to know valid event IDs.

RHEventSeries._process_DELETE

indico/modules/events/series/controllers.py

This function, responsible for handling DELETE requests to remove event series, was vulnerable because its parent class `RHEventSeries` inherited from `RH`, which does not enforce authentication or authorization. This allowed any unauthenticated user to delete event series.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.