CVE-2026-27490: Combodo iTop Information Disclosure Flaw

CVE-2026-27490 Overview

Combodo iTop is a web-based IT Service Management (ITSM) tool used by organizations to manage IT assets, incidents, and change requests. Versions prior to 3.2.3 protect unauthenticated access to inline images using only a 24-bit pseudo-random secret. Attackers can brute force this secret because the entropy is low and the comparison is not constant-time. Successful enumeration exposes inline image attachments to unauthenticated network attackers. The issue is tracked as CWE-330: Use of Insufficiently Random Values and is fixed in iTop 3.2.3.

Critical Impact
Unauthenticated attackers can guess or brute force the 24-bit secret protecting inline images in iTop, exposing potentially sensitive attachments stored within the ITSM platform.

Affected Products

Combodo iTop versions prior to 3.2.3
Web-based ITSM deployments exposing inline image endpoints
Instances relying on the legacy mt_rand-generated attachment secret

Discovery Timeline

2026-08-21 - CVE-2026-27490 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-27490

Vulnerability Analysis

The vulnerability resides in how iTop protects inline images that are reachable without authentication. Each attachment is assigned a secret value used as a capability token in the request URL. Prior to 3.2.3, this secret was generated using mt_rand(0, 0xFFFFFF) and formatted as a 6-character hexadecimal string. That produces only 16,777,216 possible values, which is trivially enumerable over the network against an unauthenticated endpoint. An attacker who can iterate through the space can retrieve inline images belonging to any object without needing valid credentials.

A second defect compounds the weakness. The secret comparison used a plain != operator with a fixed usleep(200) delay, which does not eliminate timing observability and provides no cryptographic guarantees. The combined effect is disclosure of image content associated with iTop objects such as tickets, changes, or knowledge articles.

Root Cause

The root cause is the use of a non-cryptographic pseudo-random number generator with insufficient output width to protect a network-reachable resource. mt_rand is a Mersenne Twister PRNG suitable for simulations but not for security tokens, and 24 bits of entropy is insufficient to withstand online brute forcing.

Attack Vector

Exploitation requires only network access to the iTop web interface. An unauthenticated attacker enumerates candidate secret values against the inline image endpoint for a known object identifier. Because the secret space is small, a modestly parallelized client can exhaust it and retrieve the underlying image resource.

php

// Patch: pages/ajax.render.php
// Before (vulnerable): 24-bit secret from a non-CSPRNG
- $oAttachment->Set('secret', sprintf('%06x', mt_rand(0, 0xFFFFFF))); // something not easy to guess
// After (fixed): 128 bits of entropy from a CSPRNG
+ $oAttachment->Set('secret', bin2hex(random_bytes(16))); // 128 bits of entropy, cryptographically secure

php

// Patch: core/ormdocument.class.inc.php
// Before (vulnerable): non-constant-time comparison with fixed sleep
- if (($sSecretField != null) && ($oObj->Get($sSecretField) != $sSecretValue)) {
-     usleep(200);
// After (fixed): constant-time hash comparison
+ if (($sSecretField != null) && !hash_equals($oObj->Get($sSecretField), $sSecretValue)) {
      throw new Exception("Invalid secret for class '$sClass' - the object does not exist or you are not allowed to view it");
  }

Source: Combodo/iTop commit 9c39efd9

Detection Methods for CVE-2026-27490

Indicators of Compromise

High-volume sequential or randomized requests to iTop inline image or attachment endpoints from a single source
Repeated HTTP responses indicating invalid secret errors originating from core/ormdocument.class.inc.php
Successful image retrievals for object IDs by clients that never authenticated to the application

Detection Strategies

Baseline normal request rates to attachment and inline image URLs, then alert on deviations consistent with secret enumeration
Correlate large numbers of 4xx responses from iTop endpoints followed by a 200 response for the same object identifier
Inspect web server logs for query parameters iterating across the 6-character hexadecimal secret space

Monitoring Recommendations

Enable verbose access logging on the iTop web tier and forward logs to a centralized analytics platform
Deploy rate limiting or a WAF rule to throttle requests to attachment endpoints per source IP
Track version drift so instances running iTop below 3.2.3 are flagged for prioritized patching

How to Mitigate CVE-2026-27490

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which replaces the 24-bit secret with 128 bits from random_bytes and uses hash_equals for comparison
Restrict network exposure of the iTop web interface to trusted networks or behind a VPN until patched
Review web server and application logs for prior enumeration attempts against inline image endpoints

Patch Information

The fix is delivered in iTop 3.2.3 and is described in GitHub Security Advisory GHSA-3jr5-rqmx-97gc. The corresponding code change is available in the upstream commit 9c39efd9, which replaces mt_rand with random_bytes(16) and swaps the non-constant-time != check for hash_equals.

Workarounds

Place iTop behind an authenticating reverse proxy so unauthenticated clients cannot reach inline image endpoints
Apply WAF rate limits on attachment URLs to slow brute force attempts against the secret space
Rotate or regenerate attachment secrets after upgrading so tokens created under the weak scheme are no longer valid

bash

# Example: verify installed iTop version and plan upgrade
grep -R "ITOP_VERSION" /var/www/itop/ | head
# Upgrade path: back up database and files, then deploy iTop 3.2.3+
# See vendor documentation for the exact upgrade procedure