Is CVE-2026-107394 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107394?

CVE-2026-107394 has a CVSS v3 severity of MEDIUM (6.8).

Back

CVE-2026-107394

Description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.