Combodo iTop CVE-2026-31936

Exploitation requires a valid authenticated session in Combodo iTop with at least low-privilege user rights (confirmed by CVSS PR:L). The vulnerable code path is triggered through the iTop search interface when the AJAX call reaches AjaxRenderController::GetDataForTable() - no special or non-default configuration is needed, as the missing authorization check is present in all default iTop deployments prior to 3.2.3. The iTop instance must be reachable over a network (AV:N). Exploitation is limited to users who can authenticate; unauthenticated exploitation is not supported by the available data. The scope of data exposure varies by deployment: environments with granular role-based object class restrictions will expose more sensitive data than those with homogeneous permissions.

The NVD-assigned CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8, reflecting a network-accessible, low-complexity exploit requiring only a low-privilege session. The network and low-privilege signals are consistent with the code evidence: any authenticated iTop user can trigger the vulnerable AJAX endpoint. However, the I:H and A:H impact ratings are not well-supported by the advisory text, which describes only unauthorized read access to object information - integrity and availability impacts appear to be inferred rather than demonstrated. No EPSS score was provided, so exploitation probability cannot be independently quantified. There is no CISA KEV listing and no known public POC, suggesting exploitation has not been widely observed. Organizations where iTop role segmentation is actively used to separate sensitive IT asset classes - for example, separating helpdesk staff from contract or infrastructure data - face a meaningful risk that authenticated low-privilege users can bypass those controls entirely.

An authenticated iTop helpdesk agent with read access restricted to their assigned Configuration Items crafts a search query against an object class outside their permitted scope (such as financial contracts or infrastructure records) and submits it to the AjaxRenderController AJAX endpoint. Because GetDataForTable() does not verify read permissions before returning results, the full dataset for the queried class is returned to the attacker. No public POC has been identified, but the fix commit provides sufficient detail to reconstruct the exploit path.