CVE-2026-34836: Combodo iTop Auth Bypass Vulnerability

CVE-2026-34836 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, changes, and service requests. CVE-2026-34836 is an improper access control vulnerability [CWE-862] affecting versions prior to 3.2.3. The flaw resides in ajax.render.php and ajax.document.php, which fail to verify user permissions before returning documents. An authenticated attacker with low privileges can retrieve documents they are not authorized to view. The issue has been fixed in iTop 3.2.3.

Critical Impact
Authenticated users can access confidential documents and attachments across the iTop instance without permission checks, exposing sensitive ITSM data such as change tickets, contracts, and internal records.

Affected Products

Combodo iTop versions prior to 3.2.3
ajax.render.php endpoint
ajax.document.php endpoint

Discovery Timeline

2026-08-21 - CVE-2026-34836 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-34836

Vulnerability Analysis

The vulnerability is a missing authorization flaw in the AJAX endpoints that iTop uses to serve documents and attachments. When a client requests a document object by class and ID, the server-side handler retrieves the object without confirming that the requesting user has read permission on it, or on the host object that references it. This lets any authenticated user enumerate document identifiers and retrieve their contents. The advisory classifies the issue under CWE-862 Missing Authorization.

Root Cause

The root cause is inconsistent permission enforcement in core/ormdocument.class.inc.php. When direct read access to a document object was denied, the code fell back to loading the host object but did not correctly assert that the user held rights on that host. Attachments and regular documents were also handled with different safety checks, leaving a bypass path.

Attack Vector

Exploitation requires network access to the iTop web interface and a low-privileged authenticated session. The attacker issues crafted requests to ajax.render.php or ajax.document.php with valid document class and identifier parameters. The server returns the document content without validating that the user is authorized to view it or its parent object.

php

 			if (!is_object($oObj)) {
 				// If access to the document is not granted, check if the access to the host object is allowed
 				$oObj = MetaModel::GetObject($sClass, $id, false, true);
+				$bHasHostRights = false;
 				if ($oObj instanceof Attachment) {
 					$sItemClass = $oObj->Get('item_class');
 					$sItemId = $oObj->Get('item_id');
 					$oHost = MetaModel::GetObject($sItemClass, $sItemId, false, false);
-					if (!is_object($oHost)) {
-						$oObj = null;
+					if (is_object($oHost)) {
+						$bHasHostRights = true;
 					}
 				}
-				if (!is_object($oObj)) {
+
+				// We could neither read the object nor get a host object matching our rights
+				if ($bHasHostRights !== true) {
 					throw new Exception("Invalid id ($id) for class '$sClass' - the object does not exist or you are not allowed to view it");
 				}
 			}

The patch introduces a $bHasHostRights flag and applies the same permission gate to both attachments and regular documents. It throws an exception when neither the document nor its host object is readable by the current user. Source: Combodo iTop commit 77915853.

Detection Methods for CVE-2026-34836

Indicators of Compromise

Unusual volume of requests to ajax.render.php or ajax.document.php from a single authenticated session.
Sequential or enumerated id parameters in document AJAX requests, indicating brute-force enumeration.
Document downloads by user accounts that have no assigned role for the referenced object class.

Detection Strategies

Review iTop web server access logs for authenticated users retrieving documents outside their assigned scope.
Correlate document access events with the requesting user's role and organization to identify cross-tenant access.
Alert on requests to the vulnerable endpoints where the referenced object class does not match the user's permitted classes.

Monitoring Recommendations

Enable verbose access logging on the iTop application server and forward logs to a centralized SIEM.
Monitor for spikes in HTTP 200 responses from ajax.document.php correlated with low-privilege accounts.
Track post-authentication behavior to baseline normal document retrieval patterns per role.

How to Mitigate CVE-2026-34836

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which contains the official fix.
Audit user accounts and revoke unnecessary access to the iTop portal, especially guest or contractor accounts.
Review recent document access logs for evidence of unauthorized retrieval prior to patching.

Patch Information

The fix is included in Combodo iTop 3.2.3 and is implemented in core/ormdocument.class.inc.php. Details are available in the GitHub Security Advisory GHSA-2gvp-4cv3-cx6j and the upstream commit.

Workarounds

Restrict network access to the iTop application to trusted users and VPN clients until the upgrade is completed.
Place a web application firewall (WAF) rule in front of ajax.render.php and ajax.document.php to block requests from low-trust user roles.
Rotate any credentials, API tokens, or sensitive attachments that may have been exposed to unauthorized readers.

bash

# Upgrade iTop to the patched release
cd /var/www/itop
git fetch --tags
git checkout 3.2.3
# Then run the setup/upgrade wizard at https://<itop-host>/setup/