Indico, an event management platform built on Flask, omitted an access check on the API endpoint that manages event series. This flaw lets an unauthenticated or unauthorized user read the series title, category chain, and dates; delete an entire series; or modify its details. The attack is limited to manipulating series structure and no direct access to the events themselves or tampering with user‑visible event data. The weakness is a classic case of missing authentication for privileged operations (CWE-306).

Any Indico deployment running a version earlier than 3.3.11 is affected. The fix was introduced in release 3.3.11 and later. Version 3.3.11 and newer eliminate the missing access check, restoring proper authorization controls for all series‑management actions.

The CVSS score of 6.5 categorises the vulnerability as moderate, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog, suggesting that large‑scale, widespread attacks are not documented. The likely attack path involves an attacker sending HTTP requests to the series‑management endpoint when it is publicly reachable; no additional credentials are required. Consequently, the risk is primarily to data integrity and availability for the event series themselves, with limited impact on individual event content.