Skip to main content

Combodo iTop CVE-2026-34948

| EUVDEUVD-2026-64187 HIGH
Information Exposure (CWE-200)
2026-08-21 GitHub_M
Information Disclosure Itop Combodo
7.7
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.7 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vuln.today AI
7.7 HIGH

Web-delivered OQL bypass requires low-privilege auth (PR:L); scope changes because cross-silo tenant data is exposed; read-only impact justifies I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 21, 2026 - 23:21 vuln.today
Analysis Generated
Aug 21, 2026 - 23:21 vuln.today
Patch available
Aug 21, 2026 - 23:02 EUVD
CVE Published
Aug 21, 2026 - 22:26 cve.org
HIGH 7.7

DescriptionCVE.org

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

AnalysisAI

Access control bypass in Combodo iTop prior to 3.2.3 allows authenticated low-privileged users to read data outside their assigned silos via crafted OQL queries. The iTop silo isolation mechanism - which restricts users to specific data partitions - fails to apply visibility filters to classes joined in OQL but not explicitly listed in the SELECT clause, enabling cross-silo confidential data disclosure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated iTop account with OQL query submission privileges (confirmed PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.7 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects network-accessible exploitation at low complexity by any authenticated user, with a scope change indicating that data outside the user's security boundary is reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Combodo iTop to version 3.2.3 or later per the vendor advisory at https://github.com/Combodo/iTop/security/advisories/GHSA-cm4j-52rf-whgc (patch commit e467ca83cfcfc5ba1f1d78a99d4805e595f114ba). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Combodo iTop instances and identify those running versions prior to 3.2.3, then assess whether multi-silo configurations are in use. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Itop

View all
CVE-2022-24780 HIGH POC
8.8 Apr 05

Combodo iTop is a web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely e
CVE-2018-10642 HIGH POC
7.2 May 02

Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary co
CVE-2022-31403 MEDIUM POC
6.1 Jun 14

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. Rated

CVE-2022-31402 MEDIUM POC
6.1 Jun 10

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. Ra
CVE-2024-32870 MEDIUM POC
5.8 Nov 05

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.8), this vulnerability is

CVE-2024-54139 CRITICAL
9.6 Dec 13

Combodo iTop is an open source and web-based IT service management platform. Rated critical severity (CVSS 9.6), this vu
CVE-2026-39975 CRITICAL
9.4 Aug 24

Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .
CVE-2022-24870 MEDIUM POC
5.4 Apr 21

Combodo iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely
CVE-2022-24811 MEDIUM POC
5.4 Apr 05

Combodi iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely
CVE-2024-51739 MEDIUM POC
5.3 Nov 05

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.3), this vulnerability is

CVE-2026-30864 HIGH
8.9 Aug 24

Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via th
CVE-2026-33240 HIGH
8.8 Aug 21

Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers t

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-34948 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy