Indico Unauthorized User Details Access Vulnerability via Legacy API

A vulnerability in Indico's legacy API for user detail retrieval allows unauthorized access to profile information of other users, bypassing admin permissions. This issue arises from a broken access control check and affects Indico versions through 3.3.7. The vulnerability can be exploited over the network, with low complexity and low privileges required.

Impact

Exploitation of this vulnerability allows for unauthorized access to user profile details, creating a privacy risk by disclosing information without consent.

Remediation

Users are advised to update Indico to version 3.3.8. Instructions for updating can be found in the Indico documentation. As a temporary workaround, access to the affected API can be restricted through web server configuration.