A missing access check in Indico’s legacy session export API allows an authenticated user to retrieve metadata for sessions that the user is not authorized to view. The exposed data includes the session title, description, and conveners. This vulnerability is a result of an absence of proper authorization enforcement, which is classified as CWE-862.

All installations of the Indico event‑management platform running a version older than 3.3.13 are affected. The issue arises when the containing event is accessible to the user, regardless of whether the user has explicit rights to the session itself. Users of Indico 3.3.13 and later are not impacted, as the fix was applied in that release.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is not available, suggesting limited exploitation data. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, reducing its current threat visibility. The attack vector requires a valid authenticated session and access to the host event; it does not allow execution of arbitrary code or denial of service. Consequently, while the impact is limited to data disclosure, the risk remains non‑negligible for environments where session information is sensitive.