CVE-2026-34741

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c
https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Combodo iTop es una herramienta de gestión de servicios de TI basada en web. Antes de la versión 3.2.3, una omisión de autenticación permite a atacantes remotos no autenticados ejecutar archivos PHP arbitrarios del directorio env-production en una nueva instancia de iTop en el entorno de producción. Este problema ha sido solucionado en la versión 3.2.3.

Information

Published : 2026-08-21 22:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-34741

Mitre link : CVE-2026-34741

CVE.ORG link : CVE-2026-34741

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-34741", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34741", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T17:45:43.149679Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Combodo", "product": "iTop", "versions": [{"status": "affected", "version": "< 3.2.3"}]}]}], "published": "2026-08-21T22:16:37.143", "references": [{"url": "https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c", "source": "security-advisories@github.com"}, {"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3."}, {"lang": "es", "value": "Combodo iTop es una herramienta de gesti\u00f3n de servicios de TI basada en web. Antes de la versi\u00f3n 3.2.3, una omisi\u00f3n de autenticaci\u00f3n permite a atacantes remotos no autenticados ejecutar archivos PHP arbitrarios del directorio env-production en una nueva instancia de iTop en el entorno de producci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 3.2.3."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}