The vulnerability arises from an incomplete validation of outgoing URLs in Indico. An event organizer can submit a crafted URL that points to a prohibited local target; the system accepts it and returns the data retrieved from that target. This allows the attacker to read sensitive information from internal services or files, potentially exposing confidential data. The weakness is a classic SSRF identified as CWE‑918.

The affected product is the Indico event management system from the vendor indico. All releases prior to version 3.3.13 are vulnerable; version 3.3.13 includes the fix.

The CVSS score of 6.8 indicates moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation is limited to users with organizer privileges and the ability to submit URLs within Indico; the attacker can read data returned from the targeted internal resource. The potential impact is the disclosure of internal data and possible escalation depending on the accessibility of the target services.