CVE-2026-108717: Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController

Q: Who is exposed to this issue?

iTop installations running versions 3.1.0 through 3.3.0 are affected if an attacker has an authenticated console-user account. The attacker must be able to send requests to the LinkSetController routes; no user interaction is required.

Q: What can an authenticated attacker do?

By supplying arbitrary class and key parameters, an attacker can bypass profile grants on the linkset delete, detach, and get-remote-object routes. This can allow deletion of objects, clearing of external keys, and reading object attributes that the user would not normally be permitted to access.

Q: Are unauthenticated users able to exploit it?

The available information identifies this as an authenticated issue affecting console users. It does not state that unauthenticated access to the affected routes is possible.

Q: How can I determine whether my deployment is affected?

Check whether the iTop version is between 3.1.0 and 3.3.0, inclusive, and whether console users can reach the LinkSetController delete, detach, or get-remote-object functionality. The issue is relevant where profile grants are relied upon to restrict access to object classes or records.

Published Oct 11, 2026

Updated

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission.

Affected Software

1 affected component

Combodo iTop>=3.1.0<=3.3.0

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

iTop installations running versions 3.1.0 through 3.3.0 are affected if an attacker has an authenticated console-user account. The attacker must be able to send requests to the LinkSetController routes; no user interaction is required.

What can an authenticated attacker do?

By supplying arbitrary class and key parameters, an attacker can bypass profile grants on the linkset delete, detach, and get-remote-object routes. This can allow deletion of objects, clearing of external keys, and reading object attributes that the user would not normally be permitted to access.

Are unauthenticated users able to exploit it?

The available information identifies this as an authenticated issue affecting console users. It does not state that unauthenticated access to the affected routes is possible.

How can I determine whether my deployment is affected?

Check whether the iTop version is between 3.1.0 and 3.3.0, inclusive, and whether console users can reach the LinkSetController delete, detach, or get-remote-object functionality. The issue is relevant where profile grants are relied upon to restrict access to object classes or records.

CVE-2026-108717: Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can an authenticated attacker do?

Are unauthenticated users able to exploit it?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can an authenticated attacker do?

Are unauthenticated users able to exploit it?

How can I determine whether my deployment is affected?