CVE-2026-31936 Overview
Combodo iTop is a web-based IT Service Management (ITSM) tool used to manage IT infrastructure, incidents, and change requests. CVE-2026-31936 is a missing authorization vulnerability [CWE-862] in the iTop search operation. Authenticated users can access object information they are not authorized to view by leveraging the search functionality exposed through the AJAX rendering controller. The issue affects all versions of iTop prior to 3.2.3 and is resolved in version 3.2.3.
Critical Impact
Authenticated attackers with low privileges can retrieve sensitive object data across the ITSM environment, exposing configuration items, incidents, contracts, and related records outside their assigned scope.
Affected Products
- Combodo iTop versions prior to 3.2.3
- iTop AJAX rendering controller (sources/Controller/AjaxRenderController.php)
- Deployments exposing ajax.render.php to authenticated users
Discovery Timeline
- 2026-08-21 - CVE-2026-31936 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-31936
Vulnerability Analysis
The vulnerability resides in the search operation handled by iTop's AJAX rendering controller. The controller processed search requests without verifying whether the requesting user held the required permissions for the target object classes. As a result, any authenticated user could submit crafted search queries and receive object attributes that iTop's role-based access control would normally block.
Because iTop stores configuration management data, incident records, contracts, and user information as objects, an authorization gap in search exposes a broad range of data. The flaw is a classic missing authorization defect [CWE-862] where an entry point exists but the identity of the caller is not evaluated against the resource being accessed.
Root Cause
The root cause is the absence of a permission check in the search handler within AjaxRenderController.php. The patch introduces the UserRights dependency into the controller so that the search operation can validate the caller's permissions before returning results. Prior to the fix, the handler trusted the request parameters and returned data for any queryable object class.
Attack Vector
Exploitation requires network access to the iTop web interface and a valid low-privilege account. The attacker issues an HTTP request to ajax.render.php invoking the search operation and specifies object classes or attributes that are outside their authorized scope. The server processes the query and returns matching records, bypassing the intended access controls.
// Patch excerpt from sources/Controller/AjaxRenderController.php
use ScalarExpression;
use SetupUtils;
use UILinksWidget;
+use UserRights;
use utils;
use WizardHelper;
Source: GitHub commit b3223eb
The patch imports the UserRights class into the AJAX rendering controller, enabling the search operation to enforce per-user permission checks before returning object data.
Detection Methods for CVE-2026-31936
Indicators of Compromise
- Unusual volume of POST or GET requests to ajax.render.php with the operation=search parameter from a single authenticated session.
- Requests referencing object classes that the authenticated user's profile does not normally query.
- Web server logs showing search operations returning large result sets to accounts with restricted profiles.
Detection Strategies
- Review iTop application logs for search operations executed by accounts that lack the corresponding read profiles on the queried classes.
- Correlate authenticated session activity with the object classes returned to identify enumeration patterns.
- Baseline normal search traffic per user role and alert on deviations that suggest privilege boundary probing.
Monitoring Recommendations
- Enable verbose audit logging for AJAX endpoints and forward events to a centralized log platform.
- Monitor authentication events tied to iTop accounts that suddenly issue high volumes of search queries.
- Track HTTP responses from ajax.render.php for anomalous payload sizes tied to search operations.
How to Mitigate CVE-2026-31936
Immediate Actions Required
- Upgrade Combodo iTop to version 3.2.3, which contains the authorization check in the search operation.
- Audit iTop user accounts and disable or reset credentials for accounts that are inactive, shared, or over-provisioned.
- Review recent search activity in application logs to identify potential unauthorized data access prior to patching.
Patch Information
Combodo released the fix in iTop 3.2.3 via commit b3223eb9b6bc1514276f8f321db1e27db6f42808. The patch adds the UserRights import and enforces permission checks in the search handler of AjaxRenderController.php. Refer to the GitHub Security Advisory GHSA-3r3r-j29m-3v43 for the full advisory.
Workarounds
- Restrict network access to the iTop interface using a web application firewall or reverse proxy that limits ajax.render.php to trusted networks.
- Enforce strict least-privilege profiles so that any successful exploitation returns the smallest possible dataset.
- Require multi-factor authentication for all iTop accounts to reduce the risk of credential-based access by external actors.
# Verify installed iTop version after upgrade
grep -R "ITOP_VERSION" /var/www/html/itop/approot.inc.php
# Confirm the patched controller contains the UserRights import
grep -n "use UserRights;" /var/www/html/itop/sources/Controller/AjaxRenderController.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
