Vulnerability details
CVE-2026-34948
Combodo iTop
Combodo iTop: Access control bypass via OQL joins
CVSS 3.1
7.7High
Official description
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.7High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Combodo | iTop | < 3.2.3 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/Combodo/iTop/security/advisories/GHSA-cm4j-52rf-whgc x_refsource_CONFIRM
- https://github.com/Combodo/iTop/commit/e467ca83cfcfc5ba1f1d78a99d4805e595f114ba x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-22
- Last updated
- 2026-08-24
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.38%
Probability of exploitation in 30 days
32.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor