CVE-2026-34948

Received Received - Intake

Silos Bypass via OQL in Combodo iTop

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-34948

Affected Vendors & Products

Vendor	Product	Version / Range
combodo	itop	to 3.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Combodo iTop versions before 3.2.3 allows unauthorized data access. The issue occurs because only classes listed in the SELECT clause are checked for silo access permissions in OQL queries. Attackers can exploit this to retrieve sensitive information they should not have access to.

Detection Guidance

To detect this vulnerability, check the version of Combodo iTop installed on your system. If it is below 3.2.3, the system is vulnerable. Use commands like 'dpkg -l | grep itop' on Debian-based systems or 'rpm -qa | grep itop' on RPM-based systems to check the installed version.

Impact Analysis

If you use Combodo iTop before version 3.2.3, attackers with limited access could potentially access confidential data through specially crafted queries. This could lead to data breaches, unauthorized information disclosure, or compliance violations depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive health data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected versions may face compliance failures, regulatory penalties, or reputational damage due to potential data exposure.

Mitigation Strategies

Update Combodo iTop to version 3.2.3 or later to address the silos access check bypass in OQL. This version includes the fix for the vulnerability where only classes in the SELECT clause were protected.

Hi! I’m here to help you understand CVE-2026-34948. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70