CVE-2025-59034 - CVE House
Back to Database
Status published Medium CVE-2025-59034

Indico may disclose unauthorized user details access via legacy API

Vulnerability Description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59034

Credits & Attribution

No credits recorded in the NVD database.

References

More from indico

View All →
CVE-2025-59035
Indico vulnerable to Cross-Site Scripting via LaTeX math code
Medium 4.6
CVE-2025-53640
Indico vulnerable to user enumeration via API endpoint
Medium 5.3
CVE-2024-45399
Indico has a Cross-Site-Scripting during account creation
Medium 4.3
CVE-2023-37901
Cross-Site-Scripting via confirmation prompts
Medium 5.4

Affected Vendor

Affected Software

indico
Vulnerable Versions:
< 3.3.8

Timeline

Official Publish: September 10th, 2025
Last Modified: September 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-639

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation