Combodo Itop

iTop PHP Object Injection RCE before 3.2.3 (fixed 3.2.3)
CVE-2026-40877 8.7 - High - August 24, 2026

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

Marshaling, Unmarshaling

Reflected XSS via dashboard revert in Combodo iTop pre3.2.3
CVE-2026-30864 8.9 - High - August 24, 2026

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop <3.2.3 Unauth Delete .readonly File -> Code Exec
CVE-2026-39975 9.4 - Critical - August 24, 2026

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Code Injection

Combodo iTop <=3.2.3 Unauth Delete .readonly File Deny Write
CVE-2026-34949 6.5 - Medium - August 21, 2026

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Missing Authentication for Critical Function

Combodo iTop OQL SELECT Silo Bypass (3.2.3)
CVE-2026-34948 7.7 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Information Disclosure

Combodo iTop <3.2.3: Improper Access in ajax.render.php & ajax.document.php
CVE-2026-34836 6.5 - Medium - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

AuthZ

iTop auth bypass before 3.2.3 allows PHP exec via env-production
CVE-2026-34741 8.6 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Missing Authentication for Critical Function

Combodo iTop <=3.2.3 Sensitive Info Disclosure via Error Messages
CVE-2026-33333 3.5 - Low - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

Generation of Error Message Containing Sensitive Information

XSS in iTop FK Search Criteria API (before 3.2.3, fixed 3.2.3)
CVE-2026-33240 8.8 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop <3.2.3 Object Lock Bypass (Write Permissions)
CVE-2026-33047 4.3 - Medium - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

AuthZ

Combodo iTop Unauth Object Info via Search (<=3.2.2, fixed 3.2.3)
CVE-2026-31936 8.8 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

AuthZ

Combodo iTop < 3.2.3 Reflected XSS in Universal Search
CVE-2026-31880 8 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop prior 3.2.3 XSS via tagadmin.php fixed in 3.2.3
CVE-2026-31803 8 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop <3.2.3 XSS in Synchro Import Script
CVE-2026-30890 8 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop Reflected XSS in Dashboard Save <3.2.3
CVE-2026-30865 7.1 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop XSS via OQL query fixed in 3.2.3
CVE-2026-30826 8 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

XSS

iTop Reflected XSS via dashboard_id before 3.2.3
CVE-2026-30819 7.3 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

XSS

Combodo iTop 3.2.3 - Weak 24-bit Secret for Inline Images (Unauth Access)
CVE-2026-27490 7.5 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

Insufficient Entropy

Combodo iTop <=3.2.2 Log In Page Reveals Full Version via Title Attribute
CVE-2026-27463 5.3 - Medium - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.

Information Disclosure

User Enum via Reset Password in Combodo iTop < 3.2.3
CVE-2026-27462 7.5 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

Observable Response Discrepancy

Combodo iTop <=3.2.2: Unauth Access to Uploaded Sensitive Data via Sniffed URL
CVE-2026-30866 7.5 - High - August 21, 2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

Missing Authentication for Critical Function

Combodo iTop XSS via export.php (pre-2.7.13 & pre-3.2.2)
CVE-2025-64167 7.1 - High - November 10, 2025

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execution) when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead.

XSS

Combodo iTop <2.7.13/3.2.2: Webhook Enables DB Drop
CVE-2025-49145 8.7 - High - November 10, 2025

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

AuthZ

iTop 3.x IDOR: ModuleInstallation creation allowed fixed in 3.2.2
CVE-2025-48878 4.3 - Medium - November 10, 2025

Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.

AuthZ

CVE-2025-48065 Combodo iTop 2.x/3.x XSS in error msg before 2.7.13/3.2.2
CVE-2025-48065 8.8 - High - November 10, 2025

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

XSS

Combodo iTop 3.2.x XSS in User Portal Browse Brick
CVE-2025-48055 8.5 - High - November 10, 2025

Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.

XSS

XSS in Combodo iTop <2.7.13, <3.2.2 via AJAX Dashboard
CVE-2025-47932 8.8 - High - November 10, 2025

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack.

XSS

Combodo iTop XSS via AJAX Dashboard Edit (<2.7.13, <3.2.2)
CVE-2025-47773 8.8 - High - November 10, 2025

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

XSS

Code Exec via Config in Combodo iTop <2.7.13/3.2.2
CVE-2025-47286 - November 10, 2025

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on it.

Injection

iTop <3.2.1: URL Picture ID Disclosure
CVE-2025-24969 - May 14, 2025

iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the issue.

Insecure Direct Object Reference / IDOR

iTop v2.7.12/3.1.3/3.2.1 Fix: Auth'd Users Access Unprotected Data
CVE-2024-52601 - May 14, 2025

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Insecure Direct Object Reference / IDOR

XSS via CSV import in iTop before v3.1.3 / v3.2.1
CVE-2024-56157 - May 14, 2025

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it.

XSS

iTop < 2.7.12/3.1.3/3.2.1: Field Manipulation via Portal Access
CVE-2025-24021 - May 14, 2025

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

AuthZ

iTop Server Code Execution in v2.7.x, 3.1.x, 3.2.x prior to 2.7.12/3.1.3/3.2.1
CVE-2025-24022 8.6 - High - May 14, 2025

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.

Shell injection

iTop ReDoS Vulnerability (v <= 3.2.1) – RegExp DoS
CVE-2025-24026 - May 14, 2025

iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS.

ReDoS

iTop 3.2.0 Dashboard PHP Error Crash via Malformed layout_class
CVE-2025-24785 - May 14, 2025

iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layout_class before saving the dashboard.

Improper Input Validation

XSS in Combodo iTop Preferences Page v<2.7.12,3.1.2,3.2.0
CVE-2025-27139 5.4 - Medium - February 25, 2025

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.

XSS

Combodo iTop Cross-Site Scripting and Request Forgery Vulnerability in _table_id Parameter
CVE-2024-54139 9.6 - Critical - December 13, 2024

Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue.

Session Riding

URL ID Manipulation Vulnerability in Map Element of iTop
CVE-2024-22117 - November 26, 2024

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.

iTop 3.1 Reflected XSS via Request Payload
CVE-2024-52000 6.1 - Medium - November 08, 2024

Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability.

XSS

Combodo iTop 3.2 Portal Access Control Bypass
CVE-2024-52001 4.3 - Medium - November 08, 2024

Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Information Disclosure

CSRF in Combodo iTop URL Endpoints
CVE-2024-52002 8.8 - High - November 08, 2024

Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Session Riding

Combodo iTop before 3.2.0 Cleartext Password Exposure
CVE-2024-51993 - November 07, 2024

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database.

Cleartext Storage of Sensitive Information

Combodo iTop 3.2.0 CSRF Route Dispatch Bypass
CVE-2024-51995 - November 07, 2024

Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Authorization

iTop XSS via Text File Upload
CVE-2024-51994 5.4 - Medium - November 07, 2024

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

XSS

Combodo iTop SSRF Vulnerability
CVE-2024-51740 8.8 - High - November 05, 2024

Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

SSRF

Combodo iTop User Enumeration Vulnerability
CVE-2024-51739 5.3 - Medium - November 05, 2024

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `"UI:ResetPwd-Error-WrongLogin"` through an extension and replace it with a generic message.

Side Channel Attack

Combodo iTop Info Disclosure via URI Access
CVE-2024-32870 5.8 - Medium - November 05, 2024

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Information Disclosure

Combodo iTop XSS in AJAX Search Form
CVE-2023-34444 6.1 - Medium - November 05, 2024

Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

XSS

iTop XSS via Run Queries Page
CVE-2023-34443 6.1 - Medium - November 05, 2024

Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

XSS