Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-59034

Good to know:

icon
icon
icon

Date: September 10, 2025

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

Severity Score

Related Resources (5)

https://github.com/indico/indico/security/advisories/GHSA-4269-mcfh-cp7q
https://nvd.nist.gov/vuln/detail/CVE-2025-59034
https://github.com/indico/indico/releases/tag/v3.3.8
https://github.com/indico/indico
https://www.mend.io/vulnerability-database/CVE-2025-59034

Severity Score

Weakness Type (CWE)

Authorization Bypass Through User-Controlled Key

CWE-639

Top Fix

icon

Upgrade Version

Upgrade to version indico - 3.3.8;https://github.com/indico/indico.git - v3.3.8

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us