CVE-2026-27462: Combodo iTop Information Disclosure Flaw

CVE-2026-27462 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used for asset tracking, incident management, and change management. A user enumeration vulnerability affects iTop versions prior to 3.2.3. The application returns different responses for valid and invalid usernames through the reset password mechanism. Attackers can leverage this behavior to determine which usernames exist in the system without authentication. The issue is tracked under CWE-204: Observable Response Discrepancy and was fixed in iTop version 3.2.3.

Critical Impact
Unauthenticated attackers can enumerate valid user accounts through the password reset endpoint, enabling targeted credential attacks against confirmed identities.

Affected Products

Combodo iTop versions prior to 3.2.3
iTop web-based IT service management platform
Deployments exposing the forgot-password endpoint to untrusted networks

Discovery Timeline

2026-08-21 - CVE-2026-27462 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-27462

Vulnerability Analysis

The vulnerability resides in the iTop password reset workflow. Prior to version 3.2.3, the reset password mechanism returned distinct responses depending on whether the submitted username matched an existing account. These response differences included variations in messages, error handling, and behavior triggered by internal exceptions.

An unauthenticated attacker on the network can submit crafted reset-password requests and infer account existence from the responses. Confirmed usernames become inputs for credential stuffing, password spraying, or phishing campaigns targeting legitimate identities.

Root Cause

The application distinguished error paths using dedicated exception classes such as ForgotPasswordUserInputException and ForgotPasswordApplicationException. Different exceptions surfaced different messages to the client. The fix standardizes the return message so that valid and invalid usernames produce identical output, closing the [CWE-204] observable response discrepancy.

Attack Vector

Exploitation requires only network access to the iTop login and password reset pages. No authentication, user interaction, or elevated privileges are needed. An attacker automates POST requests to the forgot-password endpoint using a wordlist of candidate usernames or email addresses. The differing responses reveal which entries correspond to real accounts.

php

// Patch: application/exceptions/ForgotPasswordApplicationException.php
<?php

/**
 * @copyright   Copyright (C) 2010-2026 Combodo SAS
 * @license     http://opensource.org/licenses/AGPL-3.0
 */

class ForgotPasswordApplicationException extends Exception
{
}

// Patch: application/exceptions/ForgotPasswordUserInputException.php
class ForgotPasswordUserInputException extends Exception
{
}

Source: Combodo iTop commit 9fd0ffd. The patch introduces dedicated exception classes handled uniformly so the response returned to the user no longer varies by username validity.

Detection Methods for CVE-2026-27462

Indicators of Compromise

High volumes of POST requests to the iTop forgot-password URL originating from a single IP or narrow IP range.
Sequential or dictionary-style username values submitted to the password reset form.
Failed reset attempts followed by successful authentications for the same accounts, indicating enumeration preceded credential attacks.

Detection Strategies

Enable HTTP access logging on the iTop web server and alert on repeated hits to the password reset endpoint from the same source.
Correlate password reset activity with subsequent login attempts to identify enumeration-to-credential-stuffing chains.
Deploy Web Application Firewall (WAF) rules that rate-limit unauthenticated requests to authentication and account recovery paths.

Monitoring Recommendations

Track baseline volume of password reset submissions and alert on statistically significant deviations.
Monitor for User-Agent strings associated with common enumeration and fuzzing tools.
Review authentication telemetry for password spraying that immediately follows bursts of reset requests.

How to Mitigate CVE-2026-27462

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which standardizes password reset responses.
Restrict access to the iTop web interface to trusted networks or VPN users where possible.
Enforce multi-factor authentication (MFA) for all iTop accounts to reduce the value of enumerated usernames.

Patch Information

Combodo published the fix in the GitHub Security Advisory GHSA-888g-gv33-xwwx and delivered it via commit 9fd0ffd. The patch introduces ForgotPasswordApplicationException and ForgotPasswordUserInputException classes handled uniformly, ensuring a single, generic response is returned regardless of username validity.

Workarounds

Place the iTop password reset endpoint behind a WAF or reverse proxy that enforces rate limiting on unauthenticated requests.
Restrict the forgot-password page to authenticated internal users where operational workflows allow.
Implement CAPTCHA on the password reset form to slow automated enumeration attempts.

bash

# Example nginx rate limiting for iTop password reset endpoint
limit_req_zone $binary_remote_addr zone=itop_reset:10m rate=5r/m;

location /pages/UI.php {
    limit_req zone=itop_reset burst=5 nodelay;
    proxy_pass http://itop_backend;
}