CVE-2026-39975

CriticalCVSS 9.4/10Last modified Oct 12, 2026

Description

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-399767.1Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_crede CVE-2026-399776.3flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths CVE-2026-399796.5jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a CVE-2026-39986.4The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcod CVE-2026-399807.2OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file doe CVE-2026-399818.8AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to vali CVE-2026-399838.6basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parame CVE-2026-399845.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerab CVE-2026-399856.1LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-399879.8marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws CVE-2026-399895.3A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, CVE-2026-39998.8A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specif