CVE-2026-34836

Published: Aug 21, 2026Modified: Oct 12, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/Combodo/iTop/commit/77915853875710f152a873842fa2a84ebd09719b

Source: security-advisories@github.com

https://github.com/Combodo/iTop/security/advisories/GHSA-2gvp-4cv3-cx6j

Source: security-advisories@github.com

Timeline

No history available yet.