Executive brief
Combodo iTop is a web-based IT service management platform used by organizations to track and manage IT assets and requests. The application stores inline images with a weak 24-bit secret that lacks proper cryptographic protection, allowing attackers to brute-force and access these images without authentication. This could expose sensitive information embedded in service tickets, configuration documents, or other IT service records.
Technical details
The vulnerability involves insufficient entropy (CWE-331) in the secret generation mechanism used to protect inline images in iTop. Inline images are accessible without authentication but are protected by a 24-bit pseudo-random secret, which is cryptographically weak and susceptible to brute-force attacks (2^24 ≈ 16 million possible values). An attacker can enumerate secrets over the network without authentication or user interaction to access restricted images. The issue is fixed in versions 3.2.3 and 3.3.0 by implementing a cryptographically secure 128-bit secret generation mechanism.
Affected products
- Combodo iTop before 3.2.3
Timeline
- 2026-08-21: disclosed: CVE-2026-27490 and GHSA-3jr5-rqmx-97gc published
- 2026: patched: Fixed in versions 3.2.3 and 3.3.0