—0.0

PYSEC-2026-1459

Indico Insecure Access

Quick fix

PYSEC-2026-1459 — indico: upgrade to the fixed version with the command below.

pip install --upgrade 'indico>=3.3.3'

Details

A Broken Object Level Authorization (BOLA) vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/indico

Introduced in: 3.2.9Fixed in: 3.3.3

Fixpip install --upgrade 'indico>=3.3.3'

References

https://nvd.nist.gov/vuln/detail/CVE-2024-50633[ADVISORY]
https://github.com/cetinpy/CVE-2024-50633/issues/1[WEB]
https://github.com/cetinpy/CVE-2024-50633[WEB]
https://github.com/indico/indico[WEB]
https://pypi.org/project/indico[PACKAGE]
https://github.com/advisories/GHSA-3wg7-r7q5-r2jf[ADVISORY]