CVE-2026-34948 PUBLISHED

Combodo iTop: Access control bypass via OQL joins

Assigner: GitHub_M
Reserved: 31.03.2026 Published: 21.08.2026 Updated: 21.08.2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 7.7

Product Status

Vendor Combodo
Product iTop
Versions
  • Version < 3.2.3 is affected

References

Problem Types

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE