CVE-2025-24021: iTop doesn't have mass assignment of fields in the portal form

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-14 · updated 2026-06-17
Weakness: CWE-862

Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Affected products

Combodo iTop: before 2.7.12; from 3.0.0 before 3.1.3; from 3.2.0 before 3.2.1 — fixed in 2.7.12, 3.1.3, 3.2.1

How to fix

Upgrade to a fixed version: Combodo iTop 2.7.12, 3.1.3, 3.2.1. Check the vendor advisory for mitigations.

References

https://github.com/Combodo/iTop/commit/44290db312901fc5918cc537c74561487fb3713b
https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj

Get alerted when CVE-2025-24021 or the next vulnerability affects your stack