PyPI/indico CVE-2026-28352: medium 6.5, EPSS 0.30%

Indico has a missing access check in the event series management API

Action: Upgrade indico to 3.3.11 or later.

pip install indico==3.3.11

Affected

Fixed versions

Sources

• osv: GHSA-rfpp-2hgm-gp5v
• https://github.com/indico/indico/security/advisories/GHSA-rfpp-2hgm-gp5v
• https://nvd.nist.gov/vuln/detail/CVE-2026-28352
• https://github.com/indico/indico
• https://github.com/indico/indico/releases/tag/v3.3.11

CVE-2026-28352 · published 2026-03-01T01:24:27Z · modified 2026-07-13T07:26:40.672058099Z · JSON