An attacker who can create or edit event minutes can embed crafted HTML containing malicious script. When two users edit the same minute concurrently, the conflict resolution UI displays both changes without properly sanitizing them, allowing the script to run in the viewer’s browser. This flaw is a classic reflexive or DOM‑based XSS vulnerability (CWE‑79) and provides the attacker with the victim’s first‑party context, enabling theft of session cookies, phishing, or other malicious activity.

Indico event‑management software versions earlier than 3.3.13. All users who are permitted to create or edit minutes on those releases are potentially exposed. The vulnerability surfaces during concurrent edits in the minutes editor, and the compromised script runs under the Indico origin in the victim’s browser.

The CVSS score of 4.4 indicates a moderate severity. Exploitation requires the attacker to supply a malicious minute and for a victim to view the conflict UI – a network‑based vector that relies on the victim being logged into the same Indico instance. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The payload runs in the victim’s browser, so no privileged escalation or back‑door is gained on the server. The risk is limited to the compromised user but can be amplified by phishing or social‑engineering attacks.