CVE-2026-34949 in iTop
Summary
by MITRE • 08/22/2026
Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in Combodo i versions prior to 3.2.3 represents a critical failure in access control mechanisms, specifically allowing unauthenticated actors to manipulate essential configuration files on the server. As an IT service management platform, iTop relies heavily on its internal state and file system integrity to function correctly. The .readonly file serves as a specific safeguard created during the initial setup process to enforce read-only mode for certain operations or to signal that the installation is finalized and secure against casual modification by end-users. By permitting the deletion of this file without authentication, the application exposes itself to a state where it can be forced into an unintended operational mode or have its security boundaries effectively dismantled by any user with network access to the web interface.
From a technical perspective, this flaw is classified under CWE-284 Improper Access Control and more specifically aligns with CWE-732 Incorrect Permission Assignment for Critical Resource. The root cause lies in the server-side logic failing to verify the identity or privileges of the user requesting file system operations before executing them. In many web applications, actions that modify critical infrastructure files are restricted to administrative accounts only. However, in this instance, the endpoint responsible for handling such requests did not implement adequate authorization checks. This oversight allows an attacker who can reach the application over HTTP to send a request that triggers the deletion of the .readonly file. Once this file is removed, the application may revert to a state where write operations are permitted or configuration changes become possible without proper authentication, effectively bypassing the intended security model established during installation.
The operational impact of this vulnerability extends beyond simple file manipulation. If an attacker deletes the .readonly file, they may gain the ability to modify critical configuration files that control database connections, user permissions, and application settings. This can lead to a complete compromise of the system's integrity. An adversary could alter administrative credentials, inject malicious code into configuration scripts, or disable security features entirely. In some configurations, this might also facilitate further attacks such as remote code execution if other components rely on these files for validation logic. The ability to change the operational state from read-only to writable without authentication undermines the principle of least privilege and allows non-privileged users to escalate their access level significantly within the application environment.
This vulnerability is closely related to ATT&CK technique T1078 Valid Accounts, as it exploits a lack of proper session or permission validation that effectively grants unauthorized actors administrative-like capabilities. It also touches upon T1496 Resource Hijacking if the modified state leads to resource exhaustion or misuse. The absence of authentication for such a high-impact action indicates a fundamental gap in the application's security architecture, where critical system functions are exposed through standard web endpoints without sufficient gatekeeping mechanisms.
To mitigate this risk, organizations running versions of Combodo iTop prior to 3.2.3 must upgrade immediately to version 3.2.3 or later, which includes patches for these access control flaws. For environments that cannot be upgraded instantly due to compatibility constraints, temporary mitigations should include restricting network access to the application via firewall rules so that only trusted IP addresses can interact with it. Additionally, ensuring that the web server runs under a restricted user account with limited file system permissions can reduce the impact of such vulnerabilities by preventing direct manipulation of critical files even if the application logic is bypassed. Regular security audits and penetration testing should be conducted to identify similar access control weaknesses in other parts of the application stack.