Quick answers
- Is CVE-2026-33047 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33047 being exploited in the wild.
- How severe is CVE-2026-33047?
- Medium severity, with a CVSS score of 4.3, published 21 August 2026.
- Which products and versions are affected?
- Combodo iTop prior to 3.2.3.
- Is there a fix for CVE-2026-33047?
- A patch was published on 2026-08-21: version 3.2.3 and 3.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33047 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-33047?
- Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an access control bypass in the object locking mechanism. Prior to version 3.2.3, the application did not validate user permissions before acquiring locks on objects; a user with read-only or limited access could invoke the locking function via the AJAX endpoint in pages/ajax.render.php. The attack requires network access and authentication (low privilege account), but no user interaction. An attacker can lock objects indefinitely, causing availability degradation and blocking legitimate write operations. The fix adds permission checks before lock acquisition.
Affected products
- Combodo iTop prior to 3.2.3
Timeline
- 2026-08-10: disclosed
- 2026-08-21: patched: version 3.2.3 and 3.3.0 released