CVE-2026-108717 Combodo CVE debrief

Who should care

Defenders responsible for Combodo iTop installations, security teams, and administrators of affected systems should assess exposure and prioritize remediation. They should also verify authorization settings and review compensating controls for exposed systems.

Why it matters

CVE-2026-108717 is a medium-severity vulnerability in Combodo iTop that allows authenticated users to bypass authorization and perform unauthorized actions. Defenders should assess exposure, verify authorization settings, and prioritize remediation.

• Potential unauthorized deletion of objects
• Potential unauthorized reading of object attributes
• Potential unauthorized clearing of external keys
• Verification of authorization settings required

Technical summary

The vulnerability is caused by a missing authorization check in the LinkSetController.php file of Combodo iTop versions 3.1.0 through 3.3.0. This allows authenticated console users to bypass profile grants and perform unauthorized actions, such as deleting objects, clearing external keys, and reading object attributes. The vulnerability has a medium severity and defenders should assess exposure and prioritize remediation. The CVE record and source item provide details on the vulnerability, but additional information from vendor sources may be necessary for comprehensive assessment.

Defensive priority

Medium priority for defenders to assess and remediate, as it allows for unauthorized actions

Recommended defensive actions

• Assess exposure of Combodo iTop versions 3.1.0 through 3.3.0
• Verify authorization settings for LinkSetController.php
• Restrict access to authenticated console users
• Monitor for unauthorized actions
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Combodo iTop versions 3.1.0 through 3.3.0, but additional information from vendor sources may be necessary for comprehensive assessment of affected scope, severity, and potential impact. Defenders should verify authorization settings and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.