CVE-2026-34948

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34948
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34948.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34948
Aliases
  • GHSA-cm4j-52rf-whgc
Published
2026-08-21T22:26:22Z
Modified
2026-09-11T03:30:57Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Combodo iTop: Access control bypass via OQL joins
Details

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34948.json"
}
References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e467ca83cfcfc5ba1f1d78a99d4805e595f114ba
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.7.0-alpha1
2.7.0-beta
2.7.0-beta2
3.*
3.1.0-alpha1
3.2.0-alpha1
3.2.0-rc1
3.2.0-rc2
3.2.0-rc3
3.2.1
3.2.2
ITSM_Designer_3.*
ITSM_Designer_3.1-compatibility

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34948.json"