What is the CVSS score of CVE-2026-27490?

CVE-2026-27490 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Combodo iTop are affected by CVE-2026-27490?

Combodo iTop versions prior to 3.2.3 contain an unauthenticated information disclosure vulnerability affecting inline images, allowing any network-connected attacker to access potentially sensitive…. A patch is available.

How to fix or mitigate CVE-2026-27490?

Within 24 hours, inventory all iTop deployments to identify instances running versions prior to 3.2.3. Within 7 days, implement interim controls including network segmentation to restrict iTop access to authorized networks, enable Web Application Firewall rules to rate-limit and block image enumeration attempts, and disable inline image functionality where operationally feasible. Within 30 days, monitor Combodo iTop security advisories for patch availability and testing guidance; upon release of version 3.2.3 or later, conduct pre-production testing and deploy updates to all affected systems.

Combodo iTop CVE-2026-27490

EUVD-2026-64125 HIGH

Insufficient Entropy (CWE-331)

2026-08-21 GitHub_M

Information Disclosure Itop

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated endpoint; 24-bit brute-force is low-complexity at scale; confidentiality-only impact with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 21, 2026 - 21:02 EUVD

Source Code Evidence Fetched

Aug 21, 2026 - 20:31 vuln.today

Analysis Generated

Aug 21, 2026 - 20:31 vuln.today

CVE Published

Aug 21, 2026 - 19:59 cve.org

HIGH 7.5

DescriptionCVE.org

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

AnalysisAI

Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The targeted iTop instance must be network-reachable and must have inline image attachments that were stored using the secret-protected unauthenticated access mechanism - this is iTop's intended design for embedding images in ticket views. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is broadly accurate: the endpoint is network-accessible, requires no authentication, and no user interaction is needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Combodo iTop to version 3.2.3 or later, which replaces the mt_rand()-based 24-bit secret with a cryptographically secure 128-bit value generated via random_bytes(16), and hardens the comparison with hash_equals(). … Detailed patch versions, workarounds, and compensating controls in full report.