Combodo Itop vulnerabilities

CVE-2026-30866 [HIGH] CWE-200 CVE-2026-30866: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can ac Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

CVE-2026-27462 [HIGH] CWE-204 CVE-2026-27462: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different respo Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

CVE-2026-33240 [HIGH] CWE-79 CVE-2026-33240: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross- Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

CVE-2023-48709 [HIGH] CWE-74 CVE-2023-48709: iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.

CVE-2020-4079 [HIGH] CWE-200 CVE-2020-4079: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, whe Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.

CVE-2026-30864 [HIGH] CWE-79 CVE-2026-30864: Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflec Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

CVE-2024-52002 [HIGH] CWE-352 CVE-2024-52002: Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2020-12777 [HIGH] CWE-200 CVE-2020-12777: A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthori A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.

CVE-2026-27490 [HIGH] CWE-330 CVE-2026-27490: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are acces Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

CVE-2024-54139 [CRITICAL] CWE-79 CVE-2024-54139: Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.1 Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue.

CVE-2024-31998 [HIGH] CWE-352 CVE-2024-31998: Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV impor Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2019-11215 [HIGH] CWE-79 CVE-2019-11215: In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitr In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the

CVE-2024-51995 [HIGH] CWE-284 CVE-2024-51995: Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All us

CVE-2021-32776 [HIGH] CWE-352 CVE-2021-32776: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0.

CVE-2023-47489 [HIGH] CVE-2023-47489: CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute ar CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components.

CVE-2026-34836 [MEDIUM] CWE-862 CVE-2026-34836: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in a Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

CVE-2026-30826 [HIGH] CWE-79 CVE-2026-30826: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

CVE-2026-30819 [HIGH] CWE-79 CVE-2026-30819: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

CVE-2026-31880 [HIGH] CWE-79 CVE-2026-31880: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

CVE-2026-31803 [HIGH] CWE-79 CVE-2026-31803: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.