Listen to this Post
The vulnerability in Indico arises from an insecure endpoint that exposes user details (name, email, affiliation) when accessed in bulk. Attackers can exploit this by sending crafted requests to the affected API endpoint, which is intended to display user information in ACLs and form fields. By abusing this functionality, an unauthenticated or low-privileged user can enumerate sensitive user data without proper authorization. The issue stems from insufficient access controls on the `/users/search` endpoint, allowing mass data extraction.
DailyCVE Form
Platform: Indico
Version: < 3.3.7
Vulnerability: Information Disclosure
Severity: Moderate
Date: 2025-07-15
Prediction: Patch expected by 2025-07-22
What Undercode Say
curl -X GET "http://<indico-server>/users/search?q="
import requests
response = requests.get("http://<indico-server>/users/search?q=")
print(response.json())
How Exploit
- Send GET request to `/users/search` with wildcard query.
- Extract user details in bulk.
- Automate enumeration via scripting.
Protection from this CVE
- Update to Indico 3.3.7.
- Restrict `ALLOW_PUBLIC_USER_SEARCH` in
indico.conf. - Block endpoint via web server rules.
Impact
- Mass user data leakage.
- Privacy violations.
- Potential phishing attacks.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
