CVE-2026-108717 — Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supp…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7