Detections
Analytics

SCA: security update for indico (GHSA-rfpp-2hgm-gp5v)

medium Tenable Self-Hosted Container Security Plugin ID 438054

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for
 Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access
 check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to
 getting the metadata (title, category chain, start/end date) for events in an existing series, deleting an
 existing event series, and modifying an existing event series. This vulnerability does NOT allow
 unauthorized access to events (beyond the basic metadata mentioned above), nor any kind of tampering with
 user-visible data in events. Version 3.3.11 fixes the issue. As a workaround, use the webserver to
 restrict access to the series management API endpoint. (CVE-2026-28352)

See Also

https://github.com/advisories/GHSA-rfpp-2hgm-gp5v

Plugin Details

Severity: Medium

ID: 438054

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 3/2/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.1

Percentile: 53.55

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-28352

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/1/2026

Vulnerability Publication Date: 3/1/2026

Reference Information

CVE: CVE-2026-28352

cwe: CWE-306