CVE-2026-34949 Overview
CVE-2026-34949 is a missing authentication vulnerability [CWE-306] in Combodo iTop, a web-based IT service management (ITSM) tool. Versions prior to 3.2.3 allow an unauthenticated remote attacker to delete the .readonly file on iTop instances. The .readonly file is created during setup and enforces a read-only state that blocks write actions. Deleting it removes that safeguard and enables unintended write operations against the instance. Combodo has addressed the flaw in iTop 3.2.3.
Critical Impact
An unauthenticated network attacker can remove the .readonly protection file, disabling a control that prevents write actions on the iTop instance.
Affected Products
- Combodo iTop versions prior to 3.2.3
- Combodo iTop 3.2.x branch before 3.2.3
- Fixed in Combodo iTop 3.2.3
Discovery Timeline
- 2026-08-21 - CVE-2026-34949 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-34949
Vulnerability Analysis
The vulnerability stems from a missing authentication check on a function that permits deletion of the .readonly file. iTop creates this file during the setup process to enforce a maintenance state where write actions are disabled. The endpoint responsible for handling this file does not validate the caller's identity or session. As a result, any remote user who can reach the iTop web interface can trigger deletion of the file.
Once the .readonly marker is removed, the safety control it enforces no longer applies. The integrity and availability impacts are limited but real: administrators lose a documented safeguard, and downstream write actions can proceed against an instance that was intentionally locked. The vulnerability maps to CWE-306: Missing Authentication for Critical Function. The EPSS probability is 0.22%.
Root Cause
The root cause is the absence of an authentication and authorization gate on the code path that removes the .readonly file. Sensitive filesystem state that governs application behavior must not be modifiable through unauthenticated requests. The affected handler exposed this state change directly to network callers without verifying identity.
Attack Vector
Exploitation requires only network access to the iTop web interface. The attacker issues a request to the affected endpoint, which deletes the .readonly file from the iTop instance. No credentials, tokens, or user interaction are required. Details are documented in the GitHub Security Advisory GHSA-2xh3-r27f-3pr5.
Detection Methods for CVE-2026-34949
Indicators of Compromise
- Unexpected absence of the .readonly file on an iTop instance that was placed in read-only state during setup or maintenance.
- Web server access logs showing unauthenticated requests to iTop endpoints associated with maintenance state or setup file management.
- Filesystem audit events recording deletion of .readonly by the web server user account outside of a planned maintenance window.
Detection Strategies
- Monitor the iTop application root for file deletion events targeting .readonly and correlate with the originating HTTP request.
- Alert on write actions performed against iTop shortly after the .readonly file disappears without a corresponding administrator session.
- Compare deployed iTop version against 3.2.3 across all instances and flag any running an earlier release.
Monitoring Recommendations
- Enable filesystem integrity monitoring on the iTop installation directory, with priority on the .readonly marker.
- Forward web server and PHP application logs to a central logging or SIEM platform for anomaly review.
- Track unauthenticated request patterns to iTop URLs and baseline normal setup or maintenance activity.
How to Mitigate CVE-2026-34949
Immediate Actions Required
- Upgrade all Combodo iTop instances to version 3.2.3 or later, which contains the authentication fix.
- Restrict network exposure of iTop administrative and setup endpoints to trusted management networks until patching is complete.
- Verify the presence and expected state of the .readonly file on instances intended to remain in read-only mode.
Patch Information
Combodo has released iTop 3.2.3 to remediate CVE-2026-34949. Administrators should follow the upgrade instructions and confirm the version after deployment. Additional details are available in the GitHub Security Advisory GHSA-2xh3-r27f-3pr5.
Workarounds
- Place the iTop web interface behind an authenticated reverse proxy or VPN to block unauthenticated access to the affected endpoint.
- Apply web server access control rules that deny external requests to setup and maintenance URLs.
- Recreate the .readonly file and enforce filesystem permissions that restrict deletion by the web server account where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
