CVE-2026-108388: indico >= 3.3.3, < 3.3.14

Affected technology

indico · >= 3.3.3, < 3.3.14
indico

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. Vendor/CNA’s CVSS 3.1 assessment (base score 3.5/10) rates confidentiality impact as low; integrity and availability impact as none.