CVE-2025-48878
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.
Risk Assessment
A low-privileged user can create module installation objects, potentially leading to unauthorized configuration changes and an expanded attack surface. In multi-user environments with different roles, privilege escalation risk is real.
Recommendation
Update iTop to version 3.2.2 or later. Until patched, restrict access to the iTop interface and monitor for unusual ModuleInstallation object creation.
Other vulnerabilities in Combodo iTop
See all- CVE-2026-39975Critical
Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions.
- CVE-2026-40877High
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.
- CVE-2026-30864High
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.
- CVE-2026-34949Medium
Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.
- CVE-2026-34948High
Combodo iTop prior to 3.2.3 only protects classes present in the SELECT clause with the silos access check in OQL. This issue has been fixed in version 3.2.3.
- CVE-2026-34836Medium
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.
- CVE-2026-34741High
Combodo iTop before version 3.2.3 has an authentication bypass vulnerability. An unauthenticated remote attacker can execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment.
- CVE-2026-33333Low
Combodo iTop, a web-based IT service management tool, prior to version 3.2.3 has a sensitive information disclosure vulnerability in error messages. This issue has been fixed in version 3.2.3.
- CVE-2026-33240High
Combodo iTop before version 3.2.3 has a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. An attacker can inject malicious script into query parameters.
- CVE-2026-33047Medium
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.
Original NVD description (English source)
Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS