CVE-2026-34949: Combodo iTop .readonly file deletion by unauthenticated users

CVE-2026-34949 · Severity: medium · CVSS 6.5 · Published 2026-08-21

Combodo iTop is a web-based IT service management platform used by organizations to track and manage IT assets and services. An unauthenticated attacker can delete a critical security file (.readonly) that prevents unauthorized modifications to the system, enabling them to perform write operations that should be restricted during locked-down periods. This could allow attackers to modify IT service records, create unauthorized assets, or alter critical system configurations.

Technologies: Combodo iTop. Vendors: Combodo.

Quick answers

Is CVE-2026-34949 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34949 being exploited in the wild.
How severe is CVE-2026-34949?
Medium severity, with a CVSS score of 6.5, published 21 August 2026.
Which products and versions are affected?
Combodo iTop prior to 3.2.3.
Is there a fix for CVE-2026-34949?
A patch was published on 2026-08-21: Fix available in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34949 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-34949?
Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw in the iTop file cleanup mechanism. An unauthenticated user can delete the .readonly file, which is created during the setup process to enforce read-only mode and block write actions. The issue affects iTop versions prior to 3.2.3 and stems from inadequate authentication checks during the cleanup phase. The vulnerability requires network access but no authentication or user interaction; an attacker can directly trigger the deletion via HTTP requests. The fix, available in versions 3.2.3 and 3.3.0, skips the cleanup phase if authentication is incorrect, preventing unauthenticated file manipulation.

Affected products

  • Combodo iTop prior to 3.2.3

Timeline

  • 2026-08-10: advisory: GitHub security advisory published
  • 2026-08-21: patched: Fix available in versions 3.2.3 and 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.