CVE-2026-31936

Published: Aug 21, 2026Modified: Sep 9, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/Combodo/iTop/commit/b3223eb9b6bc1514276f8f321db1e27db6f42808

Source: security-advisories@github.com

https://github.com/Combodo/iTop/security/advisories/GHSA-3r3r-j29m-3v43

Source: security-advisories@github.com

Timeline

No history available yet.