इन्डिको में इवेंट सीरीज मैनेजमेंट एपीआई में एक एक्सेस चेक गायब है

The vulnerability lies within the API endpoint responsible for managing event series. Due to a missing access check, attackers can bypass authentication and authorization controls. While the impact is considered limited, it still presents a security risk. Attackers can retrieve metadata such as the event series title, category chain, and start/end dates. More concerningly, they can delete existing event series, removing links between events and potentially altering event titles. Modification of the series metadata, such as toggling display options, is also possible. This could disrupt event organization and potentially lead to confusion among participants.

Organizations and institutions utilizing indico for event and conference management are at risk, particularly those running versions 3.3.9 or earlier. Shared hosting environments where multiple users have access to the indico instance are also at increased risk, as the vulnerability could be exploited to impact events managed by other users.

• python / server:

# Check for vulnerable indico versions
ps aux | grep 'indico.wsgi' | grep -i '3.3.9'

• generic web:

curl -I https://your-indico-instance/api/event_series/ | grep -i 'WWW-Authenticate'

• generic web:

# Check for unusual API access patterns in access logs
grep 'api/event_series/' /var/log/apache2/access.log | grep '403' # Look for denied access attempts

1. 2026-03-01Disclosure

   disclosure

1. आरक्षित2026-02-26
2. प्रकाशित2026-03-01
3. संशोधित2026-03-04
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-28352 is to upgrade indico to version 3.3.11 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. While a direct WAF rule is unlikely to be effective due to the nature of the vulnerability, restricting access to the affected API endpoint based on user roles and authentication status can provide some protection. Thoroughly review user permissions and ensure that only authorized users have access to event series management functions. After upgrading, confirm the fix by attempting to access the event series management API endpoint without proper authentication; access should be denied.