CVE-2026-34741: Combodo iTop Authentication Bypass Vulnerability

CVE-2026-34741 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by organizations to manage IT assets, incidents, and change requests. CVE-2026-34741 is an authentication bypass vulnerability [CWE-306: Missing Authentication for Critical Function] affecting iTop versions prior to 3.2.3. The flaw allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance running in the production environment. Combodo addressed the issue in iTop version 3.2.3.

Critical Impact

Unauthenticated remote attackers can invoke arbitrary PHP files within the iTop production environment, leading to integrity compromise of the ITSM instance and downstream operations data.

Affected Products

• Combodo iTop versions prior to 3.2.3
• New iTop instances deployed in the production environment
• iTop env-production directory endpoints reachable over the network

Discovery Timeline

• 2026-08-21 - CVE-2026-34741 published to the National Vulnerability Database (NVD)
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-34741

Vulnerability Analysis

CVE-2026-34741 is an authentication bypass in the iTop web application. The application fails to enforce authentication on entry points that execute PHP files located under the env-production directory. As a result, an unauthenticated attacker reachable over the network can request PHP files that the application treats as authorized endpoints. The vulnerability affects fresh iTop installations running in the production environment before hardening or manual endpoint restrictions have been applied.

The upstream fix introduces an allow-list model that limits which endpoints are treated as delegated authentication endpoints. Prior to the patch, exec.php and similar entry points lacked required authentication checks, effectively logging in requests with a default profile when no execution policy was configured.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. When no delegated authentication endpoint policy was defined, iTop silently defaulted to permitting the request rather than forcing a login. The patch introduces a new configuration flag, security.force_login_when_no_delegated_authentication_endpoints_list, and an explicit delegated_authentication_endpoints list, so modules such as itop-backup must declare which files (for example, ajax.backup.php) may bypass interactive authentication.

Attack Vector

The attack vector is remote and network-based, requires no privileges, and no user interaction. An attacker sends an HTTP request to a PHP file under the env-production directory of a vulnerable iTop instance. The application processes the request without validating the caller's identity, executing server-side logic that should have required authentication.

// Patch excerpt: core/config.class.inc.php
// N°8543 - Add checks on exec.php (#835)
'security.force_login_when_no_delegated_authentication_endpoints_list' => [
    'type'                => 'bool',
    'description'         => 'If true, when no execution policy is defined, the user will be forced to log in (instead of being automatically logged in with the default profile)',
    'default'             => false,
    'value'               => false,
    'source_of_value'     => '',
    'show_in_conf_sample' => false,
],

// Patch excerpt: datamodels/2.x/itop-backup/module.itop-backup.php
// Security
'delegated_authentication_endpoints' => [
    'ajax.backup.php',
],
// Source: https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c

Detection Methods for CVE-2026-34741

Indicators of Compromise

• Unauthenticated HTTP requests to PHP files under the iTop env-production directory, particularly exec.php and other module entry points.
• Web server access logs showing 200 responses to sensitive iTop endpoints from clients without a valid session cookie.
• Unexpected iTop audit-log entries attributed to the default profile from external IP addresses.

Detection Strategies

• Inspect iTop and reverse-proxy logs for requests to /env-production/*.php that do not carry an authenticated session identifier.
• Alert on execution of iTop backup, import, or admin PHP scripts outside of scheduled maintenance windows.
• Correlate HTTP requests with process telemetry on the iTop web server to identify PHP interpreter invocations that lack a corresponding authenticated user context.

Monitoring Recommendations

• Enable verbose access logging on the web server hosting iTop and forward logs to a centralized analytics platform for retention and correlation.
• Monitor filesystem changes under the iTop installation directory to detect unauthorized additions of PHP files.
• Baseline normal iTop endpoint traffic and alert on deviations, especially direct hits to internal module scripts.

How to Mitigate CVE-2026-34741

Immediate Actions Required

• Upgrade all iTop instances to version 3.2.3 or later, which contains the authentication check for exec.php and related endpoints.
• Restrict network exposure of iTop administrative endpoints to trusted management networks or VPN clients only.
• Review authentication configuration and set security.force_login_when_no_delegated_authentication_endpoints_list to true so that undefined execution policies fail closed.

Patch Information

Combodo released iTop 3.2.3 with the fix tracked as issue N°8543. The change adds explicit checks on exec.php, introduces the delegated_authentication_endpoints allow-list per module, and adds the security.force_login_when_no_delegated_authentication_endpoints_list configuration flag. Details are available in the GitHub Security Advisory GHSA-36h9-5qw2-jcc6 and the upstream commit.

Workarounds

• Place iTop behind a reverse proxy or web application firewall that enforces authentication before requests reach env-production PHP files.
• Block direct external access to iTop module entry points such as exec.php and permit only vetted paths required by end users.
• On systems that cannot be upgraded immediately, remove or rename unused module scripts within env-production to reduce the reachable attack surface.

# Example Nginx configuration to deny direct access to sensitive iTop endpoints
location ~* ^/env-production/.*/exec\.php$ {
    deny all;
    return 403;
}

location = /exec.php {
    allow 10.0.0.0/8;
    deny all;
}