High · published November 11, 2025
⚡ A crafty admin could wipe your entire database with just a webhook! This vulnerability in Combodo iTop could spell disaster if not addressed. 🔥 Think of it like giving someone a blank check without proper oversight — if they’re trusted enough, they can drain your entire account. In this case, admins can create webhooks, and if unchecked, they can trigger the ultimate data wipe! An attacker with the right permissions could execute a database drop, resulting in total data loss. This could lead to downtime, loss of critical information, and a chaotic scramble to recover everything. The consequences are absolutely devastating!
Think of it like giving someone a blank check without proper oversight — if they’re trusted enough, they can drain your entire account. In this case, admins can create webhooks, and if unchecked, they can trigger the ultimate data wipe! This vulnerability arises in Combodo iTop versions prior to 2.7.13 and 3.2.2, where insufficient validation of webhook callbacks allows admins to drop the database without proper checks in place.
An attacker with the right permissions could execute a database drop, resulting in total data loss. This could lead to downtime, loss of critical information, and a chaotic scramble to recover everything. The consequences are absolutely devastating! Update your iTop to version 2.7.13 or 3.2.2 immediately to ensure webhook callbacks are verified correctly. It's crucial to regularly audit user permissions and minimize access for those who can create webhooks. Don’t wait — take action now! You've got this! With these steps, you’ll lock things down tight and secure your data! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| combodo/itop | < 2.7.13 | 2.7.13 |
| combodo/itop | ≥ 3.0.0, < 3.2.2 | 3.2.2 |