CVE-2026-34948: Combodo iTop Information Disclosure Flaw

CVE-2026-34948 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, and change requests. CVE-2026-34948 is an information disclosure vulnerability in iTop versions prior to 3.2.3. The Object Query Language (OQL) silos access check only enforces filters on classes present in the SELECT clause, leaving joined and union classes unprotected. Authenticated users with limited privileges can craft OQL queries that expose data from related classes outside their authorized scope. The issue is fixed in version 3.2.3.

Critical Impact
Authenticated attackers can bypass silo-based access controls in OQL queries to read confidential ITSM data from joined classes they are not authorized to view.

Affected Products

Combodo iTop versions prior to 3.2.3
Combodo iTop web-based IT service management tool
Deployments relying on OQL silos access controls for data segregation

Discovery Timeline

2026-08-21 - CVE-2026-34948 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-34948

Vulnerability Analysis

The vulnerability resides in how iTop enforces silo-based access control during OQL query execution. OQL is iTop's SQL-like query language used for retrieving objects across the Configuration Management Database (CMDB). Silos allow administrators to segregate data so that users only see objects within their assigned organizational scope.

Before version 3.2.3, the DBObjectSearch filter logic only applied UserRights::GetSelectFilter to classes explicitly listed in the SELECT clause of an OQL query. Joined classes referenced through JOIN clauses and classes in UNION queries bypassed the silo filter entirely. An authenticated user with restricted silo access can craft queries that traverse relationships to disclose data belonging to organizations they should not access. The weakness is classified as [CWE-200] Information Exposure.

Root Cause

The root cause is incomplete enforcement of access control filters across all classes participating in a DBSearch operation. The ApplyDataFilters routine iterated only over selected classes rather than the full set of joined classes, breaking the security invariant that all queried data must pass authorization checks.

Attack Vector

Exploitation requires network access and authenticated low-privilege credentials to the iTop web interface. The attacker constructs an OQL query that joins the accessible class with a target class outside their silo, extracting data through the join relationship without triggering the missing filter enforcement.

php

// Security patch in core/dbobjectsearch.class.php
// N°8532 - Apply filters on all DBSearch classes (#848)
protected function ApplyDataFilters(): DBObjectSearch
{
    if ($this->IsAllDataAllowed() || $this->IsDataFiltered()) {
        return $this;
    }

    $oSearch = $this;
    $aClassesToFilter = $this->GetSelectedClasses();

    // Opt-in for joined classes filtering, otherwise only filter the selected class(es)
    if (MetaModel::GetConfig()->Get('security.disable_joined_classes_filter') === false) {
        $aClassesToFilter = $this->GetJoinedClasses();
    }

    // Apply filter across all classes to filter
    foreach ($aClassesToFilter as $sClassAlias => $sClass) {
        $oVisibleObjects = UserRights::GetSelectFilter($sClass, $this->GetModifierProperties('UserRightsGetSelectFilter'));
        if ($oVisibleObjects === false) {
            $oVisibleObjects = DBObjectSearch::FromEmptySet($sClass);
        }
        if (is_object($oVisibleObjects)) {
            $oVisibleObjects->AllowAllData();
        }
    }
}

Source: Combodo iTop commit e467ca8

Detection Methods for CVE-2026-34948

Indicators of Compromise

Unusual OQL queries in iTop application logs that include JOIN or UNION clauses referencing classes outside the user's normal scope.
Authenticated users accessing object identifiers or attribute values from organizations they are not assigned to.
Abnormal spikes in export volume or search API usage from low-privilege accounts.

Detection Strategies

Audit iTop web server access logs for requests to pages/UI.php, webservices/export.php, and webservices/rest.php containing crafted OQL payloads.
Correlate authenticated user activity with silo assignments to identify queries returning objects from unauthorized organizations.
Review the security.disable_joined_classes_filter configuration value after upgrade to confirm the filter is enabled.

Monitoring Recommendations

Enable verbose OQL query logging in iTop and forward logs to a central SIEM for correlation.
Alert on OQL queries containing JOIN against sensitive classes such as Person, Contact, or custom confidential CI classes.
Baseline normal query patterns per user role and flag deviations for review.

How to Mitigate CVE-2026-34948

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later immediately.
Review user role and silo assignments to confirm least-privilege access before and after the upgrade.
Rotate API tokens and reset passwords for accounts suspected of exploiting the flaw.

Patch Information

Combodo released the fix in iTop 3.2.3. The patch introduces a new configuration flag security.disable_joined_classes_filter and extends ApplyDataFilters in core/dbobjectsearch.class.php to iterate over all joined classes. Details are available in the GitHub Security Advisory GHSA-cm4j-52rf-whgc and the upstream commit.

Workarounds

Restrict iTop web access to trusted internal networks or through a VPN until patching is complete.
Temporarily reduce or remove low-privilege user accounts that require OQL query capabilities.
Disable custom portals and REST endpoints that expose OQL execution to end users.

bash

# After upgrading to iTop 3.2.3, ensure joined-classes filtering is enabled
# in conf/production/config-itop.php
'security.disable_joined_classes_filter' => false,