Combodo iTop leaks inline images through a weak 24‑bit pseudo‑random secret. Because the secret is generated without cryptographic strength, any user who can reach the image URL can retrieve the image without authentication. The vulnerability allows an attacker to read image data that might contain confidential information, leading to a moderate to high confidentiality impact (CWE‑330, CWE‑331).

All instances of Combodo iTop version 3.2.2 and earlier are affected. The issue has been fixed in version 3.2.3 and later releases.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available, so the exact exploitation probability is unknown, but the vulnerability is publicly disclosed and listed in a GitHub advisory. It is not present in the CISA KEV catalog. The attack can be performed over the network by accessing the image URL without authentication, so the threat is readily exploitable by anyone with network visibility.