Combodo iTop CVE-2026-27490

The targeted iTop instance must be network-reachable and must have inline image attachments that were stored using the secret-protected unauthenticated access mechanism - this is iTop's intended design for embedding images in ticket views. The 6-character hex secret is the sole access gate for these resources; no authentication credential is required by the attacker beyond knowledge of the attachment URL structure. Exploitation is bounded by the need to issue up to ~16,777,216 HTTP requests per target attachment, which is rate-limitable and detectable via access logs and anomaly-based controls. Only attachments created after the secret mechanism was introduced are affected; the flaw does not apply to attachments that do not use this secret field.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is broadly accurate: the endpoint is network-accessible, requires no authentication, and no user interaction is needed. The AC:L rating is slightly generous in isolation - successful exploitation requires issuing up to ~16.7M HTTP requests per attachment, which is detectable at the network and log layer and time-consuming, placing real-world exploitation effort above what AC:L typically implies. No KEV listing means active exploitation is not confirmed by CISA; no public POC is known, which further tempers urgency relative to the raw CVSS score. EPSS data was not provided in the source intelligence and cannot be assessed. The actual confidentiality impact depends on attachment content: in ITSM platforms, inline images commonly include screenshots of incident tickets, system dashboards, credential reset flows, or operational diagrams, making C:H realistic rather than theoretical. The absence of KEV and POC combined with the brute-force requirement suggests a credible but non-imminent risk; defenders should prioritize patching over emergency compensating controls.

An attacker with network access to an iTop instance observes or infers the URL pattern for an inline image attachment and identifies the 6-character hex secret parameter in the request. The attacker scripts an HTTP enumeration loop across all 16,777,216 possible secret values, detecting successful retrieval via HTTP 200 responses. Prior to the patch, response-time differentials from the non-constant-time != comparison could have been used to narrow the search space more efficiently. No public POC is known at time of analysis.