CVE-2026-108717

Executive Summary

CVE-2026-108717 is a missing authorization vulnerability in Combodo iTop versions 3.1.0 through 3.3.0, affecting the LinkSetController.php component. Authenticated console users can bypass profile grants by supplying arbitrary class and key parameters to the linkset delete, detach, and get-remote-object routes, enabling unauthorized object deletion, external key clearing, and attribute disclosure. The vulnerability carries a CVSS score of 6.3 and is currently unpatched.

Technical Analysis

The vulnerability is classified as CWE-862 (Missing Authorization) and resides in the LinkSetController.php file within Combodo iTop — an open-source IT Service Management (ITSM) and CMDB platform. The flaw allows authenticated users with valid console access to circumvent profile-based authorization controls.

The core mechanism is that the linkset routes (delete, detach, and get-remote-object) fail to enforce proper authorization checks against the requesting user's assigned profiles. By manipulating the class and key parameters supplied to these routes, an attacker can reference objects they are not authorized to access. The controller processes these parameters without validating that the authenticated user holds the requisite profile grants for the targeted object class and instance.

This is not a logic complexity issue — it is a straightforward missing authorization check. The controller trusts the supplied parameters rather than deriving the target object's authorization context from the session and cross-referencing it against the user's profile-to-class permission matrix. As a result, three distinct operations are exposed:

1. Delete route: Removes linkset entries (relationships) between objects the user should not be able to modify.
2. Detach route: Severs associations and clears external keys, potentially breaking data integrity across the CMDB.
3. Get-remote-object route: Reads object attributes that the user's profile should not expose, constituting an information disclosure vector.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms network exploitability, low attack complexity, and the requirement for low-privileged authenticated access. Confidentiality, integrity, and availability impacts are each rated Low, reflecting limited scope per exploitation event — though repeated abuse across many objects could aggregate to significant damage.

At the time of this report, no affected version list, OSV package data, or vendor patch has been published through tracked sources. The patch confidence is 0/4, indicating the vulnerability remains unpatched. No public proof-of-concept, Nuclei template, or exploit code is known to exist.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862) and the NVD description.

Step 1 — Reconnaissance and target identification: An attacker identifies an internet- or intranet-exposed iTop instance running versions 3.1.0 through 3.3.0. This can be accomplished via Shodan queries for HTTP titles or body content referencing iTop. The attacker must possess valid console credentials — even low-privileged ones — making this an insider threat or post-credential-compromise scenario. The attacker enumerates the iTop instance, identifying object classes and keys of interest (e.g., high-value configuration items, server records, or relationship mappings).

Step 2 — Triggering the authorization bypass: Using the authenticated console session, the attacker sends requests to the linkset routes — delete, detach, and get-remote-object — supplying arbitrary class and key parameters. Because LinkSetController.php does not validate these parameters against the user's profile grants, the requests are processed as if the user possessed full authorization over the targeted objects. The authorization check that should compare the user's profile permissions against the target class/key combination is absent or improperly implemented.

Step 3 — Payload/execution: The execution method is direct HTTP request manipulation against the vulnerable routes. The attacker replaces the class and key parameters with values corresponding to objects outside their authorized scope. No complex payload encoding or memory corruption is involved — the bypass is purely a matter of supplying parameters that the controller fails to validate. Since the vulnerability requires only low-privileged authenticated access and low attack complexity, exploitation is straightforward once the routes and parameter structure are understood.

Step 4 — Post-exploitation impact: Depending on which route is invoked:

• Delete: The attacker removes linkset relationships, potentially disrupting CMDB integrity, service dependency mappings, and incident/change management workflows.
• Detach: External keys are cleared, severing references between systems and objects, which can cascade into broken integrations and orphaned records.
• Get-remote-object: The attacker reads object attributes without authorization, exposing sensitive configuration data, infrastructure details, or business-critical asset information.

Repeated exploitation across many objects could amplify the aggregate integrity and availability impact beyond the per-request "Low" ratings in the CVSS vector.

Impact Assessment

The vulnerability affects organizations using Combodo iTop versions 3.1.0 through 3.3.0 for ITSM and CMDB operations. Because iTop is typically deployed as a central repository for configuration items, service maps, and change/incident data, the blast radius extends to any process dependent on that data integrity.

CVSS subscores indicate:

• Confidentiality (Low): The get-remote-object route exposes object attributes to unauthorized readers, but the scope is limited per request.
• Integrity (Low): Delete and detach routes allow unauthorized modification and destruction of relationships and external keys, but each operation is bounded.
• Availability (Low): Deleting linksets or detaching associations could disrupt service management workflows, though not catastrophically in a single action.

The overall CVSS score of 6.3 (Medium) reflects that exploitation requires authentication (PR:L) and that impacts are individually limited. However, for enterprises where iTop serves as the authoritative CMDB — driving incident routing, change approval, and asset dependency mapping — even limited unauthorized modifications can have outsized operational consequences. An attacker could subtly corrupt relationship data to mask their activity, redirect incident workflows, or exfiltrate infrastructure topology through the attribute disclosure route.

Given that no patch exists and no public exploit is known, the current risk is primarily one of undetected abuse by authenticated insiders or attackers who have obtained credentials through other means (phishing, credential stuffing, lateral movement). The absence of CISA KEV listing and public exploit code suggests no active widespread exploitation at this time, but the low complexity of the bypass makes it attractive for targeted operations.

Detection Guidance

Sigma Rule

title: Combodo iTop LinkSetController Authorization Bypass
id: 7f3a9b2e-4c1d-4e8a-9f5b-2d6e8a1c3b7f
status: experimental
description: Detects exploitation attempts of CVE-2026-108717 via LinkSetController.php routes with suspicious class/key parameters
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108717
author: Threat Intelligence Team
date: 2026/01/15
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026-108717
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection_route:
    cs-uri-stem|contains:
      - 'LinkSetController.php'
  selection_action:
    cs-uri-query|contains:
      - 'delete'
      - 'detach'
      - 'get-remote-object'
  selection_params:
    cs-uri-query|contains:
      - 'class='
      - 'key='
  condition: selection_route and selection_action and selection_params
falsepositives:
  - Legitimate administrative operations by authorized users
  - Automated integrations with proper credentials performing bulk linkset operations
level: medium

YARA Rule

rule CVE_2026_108717_iTop_LinkSet_AuthBypass
{
    meta:
        description = "Detects references to vulnerable LinkSetController.php routes in Combodo iTop 3.1.0-3.3.0"
        author = "Threat Intelligence Team"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108717"
        cve = "CVE-2026-108717"

    strings:
        $controller = "LinkSetController.php" ascii nocase
        $route_delete = "linkset/delete" ascii nocase
        $route_detach = "linkset/detach" ascii nocase
        $route_remote = "linkset/get-remote-object" ascii nocase
        $param_class = "class" ascii nocase
        $param_key = "key" ascii nocase

    condition:
        $controller and 1 of ($route_*) and all of ($param_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108717 Combodo iTop LinkSetController Authorization Bypass Attempt"; flow:established,to_server; http.uri; content:"LinkSetController.php"; nocase; http.uri; content:"delete"; nocase; http.uri; content:"class="; nocase; http.uri; content:"key="; nocase; classtype:attempted-user; reference:cve,2026-108717; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108717; sid:2026108717; rev:1;)
alert http any any -> any any (msg:"CVE-2026-108717 Combodo iTop LinkSetController Detach Route Abuse"; flow:established,to_server; http.uri; content:"LinkSetController.php"; nocase; http.uri; content:"detach"; nocase; http.uri; content:"class="; nocase; http.uri; content:"key="; nocase; classtype:attempted-user; reference:cve,2026-108717; sid:2026108718; rev:1;)
alert http any any -> any any (msg:"CVE-2026-108717 Combodo iTop LinkSetController GetRemoteObject Data Disclosure"; flow:established,to_server; http.uri; content:"LinkSetController.php"; nocase; http.uri; content:"get-remote-object"; nocase; http.uri; content:"class="; nocase; http.uri; content:"key="; nocase; classtype:attempted-recon; reference:cve,2026-108717; sid:2026108719; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [http where url.path : "*LinkSetController.php*" and url.query : "*class=*" and url.query : "*key=*"]
  [http where url.path : "*LinkSetController.php*" and (url.query : "*delete*" or url.query : "*detach*" or url.query : "*get-remote-object*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*LinkSetController.php*"
| eval suspicious_route=case(
    match(uri_query, "delete"), "delete",
    match(uri_query, "detach"), "detach",
    match(uri_query, "get-remote-object"), "get-remote-object",
    true(), "other")
| where suspicious_route!="other" AND match(uri_query, "class=") AND match(uri_query, "key=")
| stats count values(suspicious_route) as routes dc(uri_query) as unique_queries by src_ip, user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,itop,cve-2026-108717">
  <rule id="1087170" level="10" frequency="5" timeframe="120">
    <if_matched_sid>31100</if_matched_sid>
    <match>LinkSetController.php</match>
    <regex>class=.*key=</regex>
    <description>CVE-2026-108717: Repeated access to iTop LinkSetController.php with class/key parameters - possible authorization bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108717,</group>
  </rule>
  <rule id="1087171" level="8">
    <if_sid>31100</if_sid>
    <match>LinkSetController.php</match>
    <regex>get-remote-object</regex>
    <description>CVE-2026-108717: iTop get-remote-object route invoked - potential unauthorized attribute disclosure</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108717,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• Restrict network access to iTop console interfaces. Where possible, place the application behind VPN, zero-trust proxy, or IP allowlisting so that only trusted networks can reach the console.
• Enforce least-privilege on all iTop user accounts. Audit existing console users and remove unnecessary accounts or permissions. In particular, review which profiles have access to linkset operations and reduce as feasible.
• Enable comprehensive audit logging for the delete, detach, and get-remote-object routes. Monitor for anomalous class/key parameter usage (see Detection Guidance above).
• Conduct a one-time integrity audit of linksets and external keys to detect any prior unauthorized modifications.

2) Patch/upgrade steps:

• No vendor patch or fixed version is currently available. Monitor the Combodo iTop release notes, security advisories, and the NVD entry for CVE-2026-108717 for a patched release.
• When a patch is published, upgrade immediately after testing in a staging environment. Prioritize internet-facing and high-value CMDB instances.
• Do not attempt to modify LinkSetController.php directly without vendor guidance, as unauthorized code modifications may void support and introduce stability issues.

3) Long-term hardening:

• Adopt a vulnerability management program that tracks iTop releases and security advisories, ensuring rapid patching cycles.
• Implement defense-in-depth: WAF rules targeting the linkset routes, session anomaly detection, and periodic RBAC reviews.
• Conduct secure code review focusing on authorization enforcement in controllers, particularly those that accept class/key parameters. Ensure all object access is validated against the authenticated user's profile grants server-side.
• Apply network segmentation to isolate CMDB systems from general user networks, limiting the pool of potential authenticated attackers.

References

1. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-108717
2. MITRE CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. Combodo iTop Official Website: https://www.combodo.com/
4. Combodo iTop GitHub Repository: https://github.com/Combodo/iTop
5. FIRST.org EPSS: Not yet scored for this CVE

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-108717 at this time. The vulnerability is not listed in CISA KEV, no public PoC exists, and no Nuclei template has been published.