Indico allows users to supply arbitrary URLs that are requested by the application, creating a server‑side request forgery weakness (CWE‑918) where an authenticated event organizer can construct requests to internal addresses such as localhost or cloud metadata services and read any data returned, thereby potentially exposing sensitive system information or leaking credentials. The flaw also reflects a broken trust boundary (CWE‑367) that lets organizers influence outbound traffic that the system is not intended to expose. The impact is limited to confidentiality and may affect availability if repeated requests breach rate limits.

The vulnerability exists in the Indico event management system, supplied by indico:indico. Versions before 3.3.10 contain the flaw; the vendor released version 3.3.10 with a patch that prevents requests to protected endpoints. Only installations running these older releases are vulnerable.

The CVSS score of 6.9 indicates moderate severity, but the EPSS estimate of less than 1% shows the probability of exploitation is low. The flaw is not listed in the CISA KEV catalog. The attack requires that the attacker is an event organizer and can forge a URL. Typical deployments that do not expose internal resources through the public interface are thus loosely affected, and risk is further limited to organizers that are trusted by the organization.