PT-2025-2876 · Indico · Indico

Thiefmaster · CVE-2024-50633 · Published 2025-01-10 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

Name of the Vulnerable Software and Affected Versions Indico versions 3.2.9 through 3.3.5

Description A Broken Object Level Authorization (BOLA) issue allows attackers to read or access sensitive information by sending a crafted POST request to the "/api/principals" component. The supplier disputes this issue, stating that the product is designed to allow all users to retrieve certain information about other user accounts.

Recommendations For Indico versions 3.2.9 through 3.3.5, as a temporary workaround, consider restricting access to the "/api/principals" component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

IDOR

Weakness Enumeration

CWE-201

CWE-862

CWE-639

Related Identifiers

CVE-2024-50633

GHSA-3WG7-R7Q5-R2JF

PYSEC-2026-1459

Affected Products

Indico

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50633.json · Exploit
• 🔥 https://github.com/cetinpy/CVE-2024-50633/issues/1 · Exploit
• 🔥 https://github.com/cetinpy/CVE-2024-50633 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50633 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-50633 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3wg7-r7q5-r2jf · Vendor Advisory
• https://github.com/indico/indico · Note
• https://twitter.com/CVEnew/status/1880625665445421143 · Twitter Post
• https://t.me/cvedetector/15601 · Telegram Post
• https://t.me/cvenotify/108026 · Telegram Post
• https://github.com/advisories/GHSA-3wg7-r7q5-r2jf · Note
• https://twitter.com/VulmonFeeds/status/1877756000536518703 · Twitter Post
• https://pypi.org/project/indico · Note