CVE-2025-59034

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
indico	indico	< 3.3.8

References

https://github.com/indico/indico/releases/tag/v3.3.8Release Notes
https://github.com/indico/indico/security/advisories/GHSA-4269-mcfh-cp7qPatch, Vendor Advisory

Timeline

Published: Sep 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590355.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, the CVE-2025-590365.5Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic CVE-2025-590378.6DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was comp CVE-2025-590388.6Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been bri CVE-2025-590399.3Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected CVE-2025-59048.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function set CVE-2025-590404.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify CVE-2025-590419.8Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to versio CVE-2025-590427.0PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path`CVE-2025-590437.5OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use CVE-2025-590444.4Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups f CVE-2025-590457.1Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exist