CVE-2026-108717: Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
iTop installations running versions 3.1.0 through 3.3.0 are affected if an attacker has an authenticated console-user account. The attacker must be able to send requests to the LinkSetController routes; no user interaction is required.
What can an authenticated attacker do?
By supplying arbitrary class and key parameters, an attacker can bypass profile grants on the linkset delete, detach, and get-remote-object routes. This can allow deletion of objects, clearing of external keys, and reading object attributes that the user would not normally be permitted to access.
Are unauthenticated users able to exploit it?
The available information identifies this as an authenticated issue affecting console users. It does not state that unauthenticated access to the affected routes is possible.
How can I determine whether my deployment is affected?
Check whether the iTop version is between 3.1.0 and 3.3.0, inclusive, and whether console users can reach the LinkSetController delete, detach, or get-remote-object functionality. The issue is relevant where profile grants are relied upon to restrict access to object classes or records.