Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-21T23:16:24.153Z",
  "pubdate": "2026-08-21T23:16:24.153Z",
  "executiveSummary": "Combodo iTop prior to version 3.2.3 contains an access control vulnerability related to Object Query Language (OQL) processing and silo access checks. The vulnerability stems from insufficient enforcement of security silos on database classes that are not explicitly defined within the SELECT clause of an OQL query. This flaw allows unauthorized users to bypass logical access boundaries and potentially interact with data entities that should otherwise be restricted based on organizational silos.\nThe impact of this vulnerability includes potential unauthorized data access and breach of data segregation policies within multi-tenant or siloed IT service management deployments. The affected systems are instances of Combodo iTop running versions prior to 3.2.3. Attackers capable of formulating or influencing OQL queries may exploit this logic flaw to evade permission controls enforced by the application layer. No specialized authentication bypass is inherently required, but exploitation relies on the application's failure to validate access controls across all referenced or unreferenced classes within the query context.\nRisk implications remain significant for enterprise environments relying on strict tenant separation or departmental siloing within their ITIL processes. Remediation requires upgrading the Combodo iTop software to version 3.2.3 or later, where the OQL query parser and silo access validation mechanisms have been appropriately hardened to ensure comprehensive coverage of all classes involved in query execution.",
  "technicalDetails": "The root cause of the vulnerability lies within the OQL evaluation engine of Combodo iTop prior to version 3.2.3, specifically in how the access control layer handles silo restrictions. Silos in iTop are designed to logically partition data so that specific users or groups can only access records associated with their assigned organizational units or operational boundaries. During the parsing and execution of OQL queries, the security subsystem traditionally evaluates access rights against the primary classes declared in the query.\nPrior to the fix, the application logic restricted silo access checks exclusively to the classes explicitly present in the SELECT clause of the OQL statement. Consequently, if an OQL query referenced or joined other classes, or manipulated data structures outside the explicit SELECT clause, those supplementary classes failed to undergo the rigorous silo access validation checks. This creates a security gap where an authenticated user could construct or trigger specific OQL queries that reference restricted classes, thereby bypassing the intended authorization filters.\nThe affected component is the OQL query processing and authorization enforcement module within Combodo iTop versions prior to 3.2.3. The vulnerability is typically exploited by submitting maliciously crafted or manipulated OQL queries through the web interface, API endpoints, or reporting features where user-supplied query parameters are processed by the backend. Upon receiving the input, the vulnerable engine evaluates the SELECT clause against silo rules while ignoring the broader data context, returning unauthorized data sets or performing unauthorized operations on un-checked classes.\nPost-exploitation impact includes the exposure of sensitive IT service management data, unauthorized data retrieval across silo boundaries, and potential compromise of confidentiality invariants enforced by multi-tenant architectures. The attack flow relies entirely on the query logic flaw rather than memory corruption or standard injection primitives, representing an authorization logic bypass."
}