Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T22:16:37.290Z",
  "pubdate": "2026-08-21T22:16:37.290Z",
  "executiveSummary": "An improper access control vulnerability has been identified in Combodo iTop prior to version 3.2.3. The security flaw exists within the endpoint files ajax.render.php and ajax.document.php, which fail to adequately validate user permissions prior to servicing document access requests. This security deficiency introduces significant risk implications, potentially allowing unauthorized entities to retrieve sensitive documents managed within the IT service management platform without proper authorization checks. The vulnerability lowers the barrier for unauthorized data access, as attackers lacking administrative or standard privileges can potentially retrieve confidential files directly via the affected AJAX endpoints. Exploitation relies on interacting with the web-based application interface, exposing system assets to unauthorized retrieval if left unmitigated. The issue has been officially resolved in version 3.2.3 through implementation of strict access control validation.",
  "technicalDetails": "The vulnerability resides in the access control mechanisms implemented within the Combodo iTop web application, specifically targeting the server-side script files ajax.render.php and ajax.document.php. The root cause of the issue stems from missing or inadequate authorization checks prior to processing requests for document retrieval and rendering. In a secure architecture, these AJAX endpoints should enforce rigorous session validation and Role-Based Access Control (RBAC) checks to ensure that the requesting user possesses explicit permissions to access the targeted document assets. Due to the absence of these mandatory authorization validations in affected versions prior to 3.2.3, the application processes document requests unconditionally or relies solely on weak assumptions regarding client-side state.\nThe attack flow proceeds as follows: An attacker with network exposure to the iTop web application crafts an HTTP request targeting either ajax.render.php or ajax.document.php with specific parameters designed to retrieve a document identifier. Because the vulnerable scripts fail to verify authorization logic against the current user context, the backend application retrieves the requested document from storage and returns its content or rendering directly within the HTTP response. This exploitation method bypasses the intended security boundaries of the IT service management system, allowing unauthorized data exfiltration.\nThe vulnerable components are strictly constrained to the backend PHP scripts ajax.render.php and ajax.document.php within Combodo iTop. All versions prior to 3.2.3 are affected by this access control flaw. The attack vectors rely on network exposure over HTTP or HTTPS protocols directly interacting with the web application frontend and its underlying AJAX endpoints. Depending on the environment configuration, standard user privileges or even unauthenticated access vectors may be leveraged to trigger the improper permission validation logic, resulting in the unauthorized exposure of confidential operational documents, attachments, or system files processed by the rendering engine."
}