CVE-2026-34948: Combodo iTop: Access control bypass via OQL joins
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Combodo iTopto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
Which deployments are affected?
Combodo iTop versions prior to 3.2.3 are affected. The issue is fixed in version 3.2.3.
What access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and can exploit the issue remotely without user interaction. Exploitation involves OQL joins that reference classes not included in the SELECT clause.
What is the likely impact of successful exploitation?
Successful exploitation can expose information from classes that are not protected by the silos access check when used only in OQL joins. The provided vector indicates high confidentiality impact, with no indicated integrity or availability impact.