Executive brief
Indico vulnerability allows attackers to bulk dump user details
Affected products
- PyPI indico
Junglewise Threat Intelligence
CVE-2025-53640: PYSEC-2026-1462 - Indico vulnerability allows attackers to bulk dump user details
CVE-2025-53640 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: indico (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1461 - Indico vulnerable to Cross-Site Scripting via LaTeX math code
- PYSEC-2026-1460 - Indico may disclose unauthorized user details access via legacy API
- PYSEC-2026-1459 - Indico Insecure Access
- PYSEC-2026-2184 - Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12
- PYSEC-2026-2183 - Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11