This vulnerability is an example of CWE-863: Improper Authorization. A flaw in Indico 3.3.3 through 3.3.13 improperly uses the ambient web‑session user when verifying contribution‑management permissions. A low‑privileged user can induce a privileged user to generate a crafted legacy contribution export, causing sensitive speaker or author email addresses and access‑control entries to be cached in a publicly reachable API entry. The attacker then retrieves that cache entry with lower privileges, leaking restricted metadata.

The vulnerability affects Indico releases 3.3.3 through 3.3.13. Versions 3.3.14 and later contain a fix that enforces the correct user context during permission checks.

The CVSS score of 3.5 indicates a low severity impact, and the EPSS score of less than 1 percent suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited real‑world exploitation. Attackers would need to trick a privileged user into requesting a specific export, but once the cache is poisoned, the leaked information can be retrieved without additional privileges, potentially compromising personal data and permission structures.