Description
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Combodo iTop
Default version status: unaffected
3.1.0 to ≤ 3.3.0affected
pkg:github/Combodo/iTopReferences
- https://hackmd.io/@haind03/itop-linkset-unchecked-delete-detach-read-20261011 ↗
- https://github.com/Combodo/iTop/blob/3.3.0/sources/Controller/Links/LinkSetController.php#L43-L121 ↗
- https://github.com/Combodo/iTop/blob/3.3.0/sources/Controller/Links/LinkSetController.php#L272-L301 ↗
- https://github.com/Combodo/iTop ↗
- https://www.vulncheck.com/advisories/combodo-itop-3.1.0-through-3.3.0-missing-authorization-via-linksetcontroller ↗