CVE-2026-34948 in iTop
Summary
by MITRE • 08/22/2026
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified within Combodo iTop prior to version 3.2.3 represents a significant flaw in the implementation of Access Control Lists and data isolation mechanisms, specifically concerning Object Query Language execution. As an IT service management platform relying heavily on structured queries for data retrieval, iTop utilizes silos as a mechanism to enforce tenant or organizational boundaries within multi-tenant deployments. The core technical deficiency lies in how the application validates access permissions during query processing. Specifically, the security logic was designed to perform silo-based access checks exclusively against classes that were explicitly included in the SELECT clause of an Object Query Language statement. This selective enforcement created a critical bypass vector where data associated with related objects or joined tables could be accessed without undergoing the necessary isolation verification processes.
From a technical perspective, this flaw allows for unauthorized data exposure through crafted queries that leverage JOIN operations or implicit relationships between classes. When a user executes a query that retrieves specific fields from one class while simultaneously pulling in data from another class via an internal join mechanism, the application fails to validate whether the current user has permission to view the joined data if it is not part of the primary SELECT list. This oversight effectively neutralizes the silo isolation feature for any related entities involved in such queries. An attacker with valid credentials but limited permissions could exploit this behavior to retrieve sensitive information belonging to other tenants or organizational units, thereby violating the fundamental principle of multi-tenancy security which requires strict data segregation and access control enforcement across all queried resources regardless of their position within the query structure.
The operational impact of this vulnerability is severe in environments where iTop is deployed as a shared service provider solution for multiple distinct organizations. The ability to bypass silo checks means that confidential IT asset details, incident records, configuration items, or customer data from one tenant could be exfiltrated by another tenant through maliciously constructed queries. This constitutes a direct breach of confidentiality and integrity within the multi-tenant architecture. Furthermore, because this vulnerability is tied to the query parsing engine rather than a specific UI feature, it may be exploitable through API endpoints or any interface that accepts OQL input, increasing the attack surface significantly. The lack of proper validation on joined data undermines trust in the platform's ability to secure sensitive enterprise information across organizational boundaries.
This issue aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site or Silo Bypass concepts, as it involves a failure to enforce access restrictions consistently across all components of a data retrieval operation. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Data Exfiltration from Remote Systems by allowing an attacker to retrieve restricted information through query manipulation rather than direct unauthorized file system access or network sniffing. The exploitation technique resembles SQL injection patterns where structural elements of the query are manipulated to bypass security filters, although in this case it is a logic flaw within the application's ORM layer rather than raw database command injection.
To mitigate this risk and ensure secure operation, organizations must upgrade Combodo iTop to version 3.2.3 or later immediately upon availability. This release addresses the root cause by extending silo access checks to encompass all classes involved in a query, including those accessed via joins or related object references. Until an upgrade is performed, administrators should consider implementing strict input validation and parameterized queries at any custom integration layer that interfaces with iTop's API to prevent malicious OQL construction. Additionally, enabling comprehensive audit logging for database queries can help detect attempts to exploit this vulnerability by monitoring for unusual query patterns involving joins across different silos or classes outside the user's expected scope of access. Regular security assessments and penetration testing focused on multi-tenant isolation should be conducted to verify that no other similar logic flaws exist within custom modules or extensions installed alongside the core platform.