CVE-2026-30866

Published: Aug 21, 2026Modified: Aug 25, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/Combodo/iTop/commit/458a996c29db73b9ce2d374f6ce8b90c36351159

Source: security-advisories@github.com

https://github.com/Combodo/iTop/security/advisories/GHSA-8rgc-qjf3-xqq4

Source: security-advisories@github.com

Timeline

No history available yet.