CVE-2025-48878Medium· 4.3▾ SunlitCombodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when the…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.
itop >= 3.0.0, < 3.2.2Upgrade past the affected range:
itop 3.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-48065High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-49145High· 8.7Combodo iTop is a web based IT service management tool
CVE-2025-47932High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-48055High· 8.5Combodo iTop is a web based IT service management tool
CVE-2025-47286High· 7.2Combodo iTop is a web based IT service management tool
CVE-2025-47773High· 8.8Combodo iTop is a web based IT service management tool