Authorization Bypass in iTop Console via LinkSetController

Executive Summary

CVE-2026-108717 is a missing authorization vulnerability in Combodo iTop versions 3.1.0 through 3.3.0. It exists in LinkSetController.php where authenticated users can bypass profile restrictions by supplying arbitrary class and key parameters. This allows invoking routes to delete objects, clear external keys, or read object attributes without proper permissions.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to LinkSetController.php routes by monitoring HTTP requests to /linkset/delete, /linkset/detach, and /linkset/get-remote-object. Review logs for suspicious activity involving arbitrary class and key parameters. Verify if users with minimal permissions can perform delete, detach, or read operations on objects outside their granted access.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could delete or modify objects, clear external keys, or read sensitive attributes outside their granted permissions. This includes accessing objects in other organization silos or instance-wide for non-silo classes, potentially leading to data loss, unauthorized changes, or information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion, modification, or disclosure, violating GDPR's data integrity and confidentiality principles or HIPAA's access control requirements. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to compromised data security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade iTop to the latest version beyond 3.3.0 where this issue is patched. Apply strict input validation for class and key parameters in LinkSetController.php. Enforce authorization checks for all linkset routes to ensure users cannot bypass profile grants. Disable unused linkset routes if not required.

Useful 0 Not Useful 0