Combodo iTop CVE-2026-34836

Exploitation requires a valid authenticated session in Combodo iTop - the CVSS PR:L metric confirms at minimum a low-privileged account is needed. No special configuration is required beyond a default iTop installation with the document or attachment features in use (DocumentFile or Attachment objects must exist in the target organization). The vulnerability is scoped to confidentiality: an attacker cannot modify or delete documents, only read them. Exploitation is limited to authenticated users within the iTop application; unauthenticated external attackers cannot exploit this directly unless combined with a separate authentication bypass. The specific endpoints are ajax.render.php and ajax.document.php, which must be reachable by the attacker's session.

The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat: network-reachable, low complexity, requires only a low-privileged account, and produces high confidentiality loss with no integrity or availability impact. EPSS data was not supplied in the intelligence package, so exploitation probability cannot be quantified from that signal. No CISA KEV entry exists, and no public exploit code has been identified at time of analysis, suggesting this has not yet seen broad opportunistic abuse. The primary real-world risk is insider threat or compromised low-privilege accounts - any authenticated iTop user could exfiltrate documents from other organizational units or service desk tickets they should not access, which is significant in multi-tenant or multi-department deployments. The absence of KEV listing and no POC temper urgency slightly, but the straightforward exploitation path (low complexity, no user interaction) means this should be patched promptly wherever iTop serves multiple organizational units with segregated data.

An authenticated iTop user with a low-privilege account (such as a Configuration Manager or end-user portal account) crafts a direct HTTP request to ajax.document.php with the object ID and attribute code of a document belonging to a different organizational unit. Because the host-rights check was never enforced, the server returns the file content without verifying the requester's permissions. No public proof-of-concept code has been identified, but the attack requires no special tooling beyond knowledge of target object IDs, which may be discoverable via sequential enumeration.