CVE-2026-27490

High

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are…

[email protected]·CWE-330·Published 2026-08-21

CVSS

7.5

EPSS

0.00

KEV

Exploits

cve.orgen

230 chars

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

NVDen

230 chars

NVDes

272 chars

Combodo iTop es una herramienta de gestión de servicios de TI basada en web. Antes de 3.2.3, las imágenes en línea que son accesibles sin autenticación están protegidas por un débil secreto pseudoaleatorio de 24 bits. Este problema ha sido solucionado en la versión 3.2.3.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	ENISA EUVD	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N