CVE-2026-27490 Combodo iTop: Weak secret generation for inline image
Attackers can bypass authentication for inline images in Combodo iTop due to weak secret generation, allowing unauthorized access to protected content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27490?
CVE-2026-27490 is a high-severity vulnerability in Combodo iTop, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.
Which versions are affected by CVE-2026-27490?
How do I fix CVE-2026-27490?
No fix has been published for CVE-2026-27490 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27490 being exploited?
There is no known exploitation of CVE-2026-27490 in the wild and no public exploit code.
Sources
Also known as GHSA-3jr5-rqmx-97gc.