CVE-2026-33047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33047", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T18:10:50.211Z", "datePublished": "2026-08-21T21:21:53.846Z", "dateUpdated": "2026-08-21T21:42:15.348Z"}, "containers": {"cna": {"title": "Combodo iTop: Object can be locked by a user without write permissions", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc"}, {"name": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29", "tags": ["x_refsource_MISC"], "url": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29"}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"version": "< 3.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T21:21:53.846Z"}, "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3."}], "source": {"advisory": "GHSA-3qpj-3fcg-f5jc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T21:34:49.805883Z", "id": "CVE-2026-33047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:42:15.348Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33047", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T18:10:50.211Z", "datePublished": "2026-08-21T21:21:53.846Z", "dateUpdated": "2026-08-21T21:42:15.348Z"}, "containers": {"cna": {"title": "Combodo iTop: Object can be locked by a user without write permissions", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc"}, {"name": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29", "tags": ["x_refsource_MISC"], "url": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29"}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"version": "< 3.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T21:21:53.846Z"}, "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3."}], "source": {"advisory": "GHSA-3qpj-3fcg-f5jc", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T21:34:49.805883Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:34:54.070Z"}}]}}

{"affected": [{"affectedData": [{"product": "iTop", "vendor": "Combodo", "versions": [{"status": "affected", "version": "< 3.2.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3."}, {"lang": "es", "value": "Combodo iTop es una herramienta de gesti\u00f3n de servicios de TI basada en web. Antes de la versi\u00f3n 3.2.3, un objeto pod\u00eda ser bloqueado por un usuario al que no se le hab\u00edan asignado permisos de escritura. Este problema ha sido solucionado en la versi\u00f3n 3.2.3."}], "id": "CVE-2026-33047", "lastModified": "2026-10-12T16:10:00.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T21:34:49.805883Z", "version": "2.0.3"}}]}, "published": "2026-08-21T22:16:36.717", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29"}, {"source": "security-advisories@github.com", "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "iTop", "source": "cna", "vendor": "Combodo"}, "product": "itop", "vendor": "combodo"}], "created": "2026-08-21T22:30:17.405552+00:00", "updated": "2026-08-21T23:00:14.781488+00:00", "vendors": ["combodo", "combodo$PRODUCT$itop"]}