CVE-2026-108717

Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-40877

Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-34949

Combodo iTop: Unauthenticated user can delete .readonly file

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-34741

Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-31936

Combodo iTop: Unauthorized access to object information via search operation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-30890

Combodo iTop: Reflected XSS in synchro/synchro_import.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-27462

Combodo iTop: User enumeration via password reset

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-34836

Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-30866

Combodo iTop: Insecured access to uploaded images via sniffed url

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-27490

Combodo iTop: Weak secret generation for inline image

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-33240

Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-39975

Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-30864

Combodo iTop: Reflected XSS in dashboard revert

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-30865

Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-34948

Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-33333

Combodo iTop: Information disclosure in ajax.render.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-31803

Combodo iTop: Reflected XSS in tag admin

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-31880

Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-33047

Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop

CVE-2026-30826

Combodo iTop: Reflected XSS in run_query.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Combodo

Products

Itop