CVE-2026-27463: Combodo iTop Information Disclosure Flaw

CVE-2026-27463 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by enterprises to manage IT operations, configuration items, and service tickets. CVE-2026-27463 is an information disclosure vulnerability [CWE-200] affecting iTop versions prior to 3.2.3. The application exposes the complete iTop version string within the HTML title attribute of the login page logo. Unauthenticated remote users can retrieve this version data by inspecting the login page markup. Attackers can use the disclosed version to fingerprint deployments and target known vulnerabilities affecting that specific release. The issue has been fixed in version 3.2.3.

Critical Impact
Unauthenticated attackers can enumerate the exact iTop version remotely, enabling reconnaissance for version-specific exploits against affected instances.

Affected Products

Combodo iTop versions prior to 3.2.3
iTop login interface (logintwig.class.inc.php)
Deployments exposing the login page to untrusted networks

Discovery Timeline

2026-08-21 - CVE-2026-27463 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-27463

Vulnerability Analysis

The vulnerability resides in the login page rendering logic of Combodo iTop. The GetDefaultVars() method in application/logintwig.class.inc.php populated template variables sItopVersion and sVersionShort derived from the ITOP_VERSION constant. These values were rendered into the HTML title attribute of the login logo element. Any unauthenticated visitor viewing the login page source could read the exact iTop version.

Version disclosure alone does not compromise data, but it accelerates targeted attacks. Adversaries commonly automate reconnaissance to correlate exposed versions with public CVE databases and select working exploits. Because iTop typically holds sensitive configuration management database (CMDB) content, reducing pre-attack information available to adversaries meaningfully raises attacker cost.

Root Cause

The root cause is unnecessary exposure of internal build metadata to unauthenticated users. The login template embedded the full version string in a client-visible attribute rather than a generic label. This violates the principle of least information and maps directly to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Attack Vector

Exploitation is trivial. An attacker sends an unauthenticated HTTP GET request to the iTop login URL and parses the returned HTML for the logo title attribute. No authentication, user interaction, or special privileges are required. The attack is network-based and can be executed at scale against internet-facing iTop deployments.

php

// Vulnerable code removed in patch d124f8e - logintwig.class.inc.php
public function GetDefaultVars()
{
    $sVersionShort = Dict::Format('UI:iTopVersion:Short', ITOP_APPLICATION, ITOP_VERSION);
    $sIconUrl = Utils::GetConfig()->Get('app_icon_url');
    $sDisplayIcon = Branding::GetLoginLogoAbsoluteUrl();

    $aVars = [
        'sAppRootUrl'     => utils::GetAbsoluteUrlAppRoot(),
        'aPluginFormData' => $this->GetPluginFormData(),
        'sItopVersion'    => ITOP_VERSION,      // removed
        'sVersionShort'   => $sVersionShort,    // removed
        'sIconUrl'        => $sIconUrl,
        'sDisplayIcon'    => $sDisplayIcon,
    ];
}
// Source: https://github.com/Combodo/iTop/commit/d124f8ee58fa243193184ac2c55a561acdded356

The patch removes sItopVersion and sVersionShort from the template variables and replaces the login logo title with a customizable alt string sourced from the dictionary. See GitHub iTop Commit Details and GitHub Security Advisory GHSA-hm9q-8jx3-f3v5.

Detection Methods for CVE-2026-27463

Indicators of Compromise

Unauthenticated HTTP GET requests to /pages/UI.php or the iTop login URL from unknown or scanning IP ranges.
HTTP responses containing ITOP_VERSION values inside the title attribute of the login logo img element.
User-Agent strings associated with reconnaissance tooling such as Nuclei, httpx, or wappalyzer targeting the login page.

Detection Strategies

Fingerprint deployed iTop versions across the estate by scraping the login page and confirming whether the version string is present in the HTML source.
Correlate web server access logs against login-page requests from external IPs that never proceed to authentication.
Deploy web application firewall (WAF) rules that flag responses leaking ITOP_VERSION prior to remediation.

Monitoring Recommendations

Alert on high-volume anonymous access to the iTop login endpoint from single sources.
Track version headers and page metadata for all internally hosted ITSM tools and baseline deviations.
Ingest web server and reverse proxy logs into a centralized analytics platform for retrospective hunting after upgrade.

How to Mitigate CVE-2026-27463

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which removes the version string from the login page template.
Restrict access to the iTop login page to trusted networks or VPN users where operationally feasible.
Audit reverse proxy and WAF configurations to strip or rewrite response content that exposes application version data.

Patch Information

The fix is delivered in commit d124f8ee58fa243193184ac2c55a561acdded356 and included in iTop 3.2.3. The patch removes the version variables from logintwig.class.inc.php and updates dictionary files so the login logo uses a generic, customizable alt label instead of embedding ITOP_VERSION. Details are available in GitHub Security Advisory GHSA-hm9q-8jx3-f3v5.

Workarounds

Place iTop behind a reverse proxy that rewrites the login page response to remove the version string from the logo title attribute.
Apply IP allowlisting on the login page until the upgrade is completed.
Manually patch the affected template by removing sItopVersion and sVersionShort variables if an immediate upgrade is not possible.

bash

# Example: nginx sub_filter to strip version metadata from the login response
location /pages/UI.php {
    proxy_pass http://itop_backend;
    sub_filter_once off;
    sub_filter_types text/html;
    sub_filter 'title="iTop' 'title="login';
}