PT-2025-29511 · Unknown+1 · Flask-Multipass+1

Rafaelcorvino1 · Published 2025-07-14 · Updated 2025-09-15 · CVE-2025-53640

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Indico versions 2.2 through 3.3.7

Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. An endpoint used to display details of users listed in certain fields could be misused to dump basic user details (such as name, affiliation, and email) in bulk.

Recommendations: Upgrade to version 3.3.7 or later. Consider restricting user search to managers. Restrict access to the affected endpoints in the webserver configuration.

Exploit

Fix

IDOR

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-639

CWE-862

CWE-200

Related Identifiers

CVE-2025-53640

GHSA-Q28V-664F-Q6WJ

Affected Products

Flask-Multipass

Indico

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53640.json · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve202553640-detect-indico-vulnerability · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve202553640-mitigate-indico-vulnerability · Exploit
• https://github.com/indico/indico/security/advisories/GHSA-q28v-664f-q6wj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53640 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53640 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q28v-664f-q6wj · Vendor Advisory
• https://github.com/indico/indico · Note
• https://github.com/indico/indico/releases/tag/v3.3.7 · Note
• https://github.com/indico/indico/pull/6936/commits/f8583557a3da56aeea8857ae69bf17c9066c95c1 · Note
• https://twitter.com/PoC_in_Github/status/1946660676434620534 · Twitter Post
• https://t.me/cveNotify/129847 · Telegram Post
• https://t.me/cvetracker/27818 · Telegram Post
• https://t.me/cveNotify/135512 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1944887782494581059 · Twitter Post