CVE-2025-49145

Published: Nov 10, 2025Modified: Nov 21, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.2 / Impact: 5.2

Source: NVD

Description

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

Affected (2)

Products: Combodo: Itop

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Combodo Itop	Before 2.7.13
Combodo Itop	From 3.0.0 to 3.2.2

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://github.com/Combodo/iTop/security/advisories/GHSA-55q8-mfxr-pq4j

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.