CVE-2026-27490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27490", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T19:46:03.541Z", "datePublished": "2026-08-21T19:59:29.384Z", "dateUpdated": "2026-08-25T17:16:32.291Z"}, "containers": {"cna": {"title": "Combodo iTop: Weak secret generation for inline image", "problemTypes": [{"descriptions": [{"cweId": "CWE-331", "lang": "en", "description": "CWE-331: Insufficient Entropy", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-330", "lang": "en", "description": "CWE-330: Use of Insufficiently Random Values", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc"}, {"name": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0", "tags": ["x_refsource_MISC"], "url": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0"}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"version": "< 3.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T19:59:29.384Z"}, "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3."}], "source": {"advisory": "GHSA-3jr5-rqmx-97gc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T17:14:16.282177Z", "id": "CVE-2026-27490", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:16:32.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27490", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T17:14:16.282177Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T17:15:07.556Z"}}], "cna": {"title": "Combodo iTop: Weak secret generation for inline image", "source": {"advisory": "GHSA-3jr5-rqmx-97gc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"status": "affected", "version": "< 3.2.3"}]}], "references": [{"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc", "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0", "name": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "CWE-331: Insufficient Entropy"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-330", "description": "CWE-330: Use of Insufficiently Random Values"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T19:59:29.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27490", "state": "PUBLISHED", "dateUpdated": "2026-08-25T17:16:32.291Z", "dateReserved": "2026-02-19T19:46:03.541Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T19:59:29.384Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iTop", "vendor": "Combodo", "versions": [{"status": "affected", "version": "< 3.2.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3."}, {"lang": "es", "value": "Combodo iTop es una herramienta de gesti\u00f3n de servicios de TI basada en web. Antes de 3.2.3, las im\u00e1genes en l\u00ednea que son accesibles sin autenticaci\u00f3n est\u00e1n protegidas por un d\u00e9bil secreto pseudoaleatorio de 24 bits. Este problema ha sido solucionado en la versi\u00f3n 3.2.3."}], "id": "CVE-2026-27490", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27490", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T17:14:16.282177Z", "version": "2.0.3"}}]}, "published": "2026-08-21T20:16:34.157", "references": [{"source": "security-advisories@github.com", "url": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0"}, {"source": "security-advisories@github.com", "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}, {"lang": "en", "value": "CWE-331"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "iTop", "source": "cna", "vendor": "Combodo"}, "product": "itop", "vendor": "combodo"}], "created": "2026-08-21T21:45:03.157332+00:00", "updated": "2026-08-21T21:45:03.269484+00:00", "vendors": ["combodo", "combodo$PRODUCT$itop"]}