What is the CVSS score of CVE-2026-34949?

CVE-2026-34949 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-34949?

Yes, a patch is available for CVE-2026-34949. Update the affected software to the latest version immediately.

Combodo iTop CVE-2026-34949

Q: Which versions of Combodo iTop are affected by CVE-2026-34949?

Unauthenticated deletion of the iTop `.readonly` write-protection file is possible in Combodo iTop prior to version 3.2.3, allowing any remote attacker to remove a critical filesystem-based access…. A patch is available.

EUVD-2026-64189 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-08-21 GitHub_M

Authentication Bypass Itop Combodo

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth (PR:N, AV:N, AC:L); deleting the protection file yields low integrity and availability impact with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 23:21 vuln.today

Patch available

Aug 21, 2026 - 23:02 EUVD

DescriptionCVE.org

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances - a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

AnalysisAI

Unauthenticated deletion of the iTop .readonly write-protection file is possible in Combodo iTop prior to version 3.2.3, allowing any remote attacker to remove a critical filesystem-based access control mechanism. The .readonly file is created during the setup process specifically to block write operations on the iTop instance; its deletion effectively disables that safeguard without any credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond network reachability of the iTop web interface - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a remote, unauthenticated, low-complexity attack against default iTop deployments that have completed the setup process (which creates the `.readonly` file). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L captures the network-accessible, zero-friction nature of this attack, but the I:L/A:L ratings may understate the downstream consequence: removing write protection unlocks the ability to perform configuration and data modifications that the protection was explicitly designed to block, potentially serving as a prerequisite for further compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Combodo iTop to version 3.2.3 or later, which contains the vendor-released patch as confirmed by the GitHub Security Advisory GHSA-2xh3-r27f-3pr5 at https://github.com/Combodo/iTop/security/advisories/GHSA-2xh3-r27f-3pr5. … Detailed patch versions, workarounds, and compensating controls in full report.