Combodo iTop EUVD-2026-96991

Exploitation requires a valid authenticated iTop console account (any profile-bearing console user, not an anonymous visitor or portal-only user). The attacker then reaches the linkset delete, detach, and get-remote-object routes handled by LinkSetController.php and supplies arbitrary class and key parameters; the limiting factor is that the controller fails to re-check the user's profile grants against the targeted object, so the user's existing legitimate privilege level is what gates access, not the object permissions. Impact is bounded to objects reachable through these linkset routes and to the delete/detach/read operations they expose. Affected only in versions 3.1.0 through 3.3.0; deployments where console access is restricted to trusted administrators materially reduce realistic exposure.

This is a moderate-severity, authentication-gated authorization flaw rather than a high-urgency internet-facing threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the routes are network-reachable with low complexity and no user interaction, but PR:L means an attacker must already hold valid iTop console credentials - this is fundamentally an insider or compromised-account / privilege-escalation issue, not an unauthenticated mass-exploitation vector. Technical impact is partial across all three dimensions (VC:L/VI:L/VA:L), reflecting that an attacker can delete objects, clear external keys, and read attributes they should not, but only for objects reachable via the linkset routes rather than full admin takeover. No EPSS score was supplied, the CVE is not in CISA KEV, and no confirmed exploit code is listed (the HackMD reference is a technical disclosure write-up, not verified weaponized POC). The signals are internally consistent - there is no network-vs-local conflict - so the main driver of real-world risk is how many low-privileged console accounts exist in a given deployment. Treat as a standard patch-priority item: higher concern where many semi-trusted users have console access, lower where console access is tightly restricted.

A low-privileged but authenticated iTop console user crafts requests to the linkset delete, detach, or get-remote-object routes while supplying arbitrary class and key parameters that fall outside their assigned profile grants. Because LinkSetController.php does not enforce object-level authorization, the server carries out the delete/detach/read on objects the user was never permitted to touch. A detailed technical write-up describing the flaw is publicly available, but no verified weaponized exploit is listed in the provided data.