Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T22:16:36.553Z",
  "pubdate": "2026-08-21T22:16:36.553Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in Combodo iTop prior to version 3.2.3, specifically residing within the application's search operation. This security flaw enables authenticated users to bypass standard access control mechanisms and retrieve unauthorized object information to which they should not have direct visibility. The vulnerability exposes sensitive operational data managed within the IT service management tool, potentially compromising confidentiality across the deployment. The risk implications include unauthorized reconnaissance and data exposure within the affected system. Exploitation of this vulnerability requires user access to the platform and leverages flaws in how search queries process and enforce object-level authorization checks. The issue has been officially resolved by the vendor in version 3.2.3 through proper patch management and access control enforcement during search operations.",
  "technicalDetails": "The vulnerability stems from improper authorization checks during the execution of search operations within Combodo iTop prior to version 3.2.3. The root cause lies in the application logic failing to adequately validate whether the requesting user possesses the necessary privileges or object-level permissions to view specific search results returned by the query mechanism. When a user initiates a search request, the vulnerable component processes the query and returns object information indiscriminately, omitting strict permission validation on the resulting dataset. Consequently, an attacker or low-privileged user can leverage the search interface to query and enumerate objects, attributes, or metadata that are restricted under normal access control policies. The attack flow involves formulating specific search queries designed to trigger the retrieval of unauthorized records, which the application then improperly renders to the user interface. Exploitation requires network access to the web-based IT service management tool and valid user authentication, although the necessary privileges are constrained only to standard user access rather than administrative rights. The post-exploitation impact is characterized by the unauthorized extraction of sensitive IT service management data, potentially facilitating further attacks against the infrastructure by exposing internal object structures and relational data."
}