CVE-2026-33333: Combodo iTop Information Disclosure Flaw

CVE-2026-33333 Overview

Combodo iTop is a web-based IT Service Management (ITSM) tool used by organizations to manage IT operations, assets, and incidents. CVE-2026-33333 is an information disclosure vulnerability affecting iTop versions prior to 3.2.3. The flaw allows sensitive information to leak through unhandled exception error messages returned by the application. An authenticated attacker able to trigger errors in the AJAX rendering pipeline can obtain internal system details that aid further attacks. The issue is tracked as CWE-209: Generation of Error Message Containing Sensitive Information and was fixed in iTop 3.2.3.

Critical Impact
Authenticated users can retrieve sensitive backend information from raw exception messages, exposing internal paths, stack context, and application state useful for reconnaissance.

Affected Products

Combodo iTop versions prior to 3.2.3
iTop AJAX rendering component (pages/ajax.render.php)
All iTop deployments where authenticated users can invoke AJAX endpoints

Discovery Timeline

2026-08-21 - CVE-2026-33333 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-33333

Vulnerability Analysis

The vulnerability resides in the AJAX rendering handler pages/ajax.render.php. When an exception was thrown during request processing, the application echoed the raw exception message returned by $e->GetMessage() directly to the HTTP response. The message was HTML-escaped to prevent cross-site scripting, but the underlying content still contained internal application details.

Exception messages in PHP frameworks routinely include file paths, SQL fragments, class names, and configuration state. Returning that content to an authenticated user grants reconnaissance value for follow-on attacks such as SQL injection tuning, path traversal, or privilege escalation.

User interaction is required to trigger the vulnerable code path, and only confidentiality is affected. The flaw does not directly enable data modification or denial of service.

Root Cause

The root cause is improper exception handling in the AJAX renderer. Developer-oriented exception text was surfaced to end users instead of a generic error string. This is a canonical [CWE-209] pattern where diagnostic output intended for logs reaches the client response.

Attack Vector

An authenticated attacker sends a crafted request to an AJAX endpoint that triggers an exception during data fetch or rendering. The server then returns the exception message in the response body. The attacker parses that content to enumerate internal paths, database context, or component state.

php

// Patch diff from pages/ajax.render.php
// Source: https://github.com/Combodo/iTop/commit/170014e8f0a01fb8f8581902c665ff5c1fcc1168

    $oKPI->ComputeAndReport('Data fetch and format');
    $oPage->output();
} catch (Exception $e) {
-    // note: transform to cope with XSS attacks
-    echo utils::EscapeHtml($e->GetMessage());
+    echo utils::EscapeHtml(Dict::S('UI:PageTitle:FatalError'));
    IssueLog::Error($e->getMessage()."\nDebug trace:\n".$e->getTraceAsString());
}

The patch replaces the raw exception message with a localized generic fatal error string, while still logging the full exception and trace server-side via IssueLog::Error().

Detection Methods for CVE-2026-33333

Indicators of Compromise

HTTP responses from /pages/ajax.render.php containing PHP exception text, file paths, or stack context
Repeated authenticated requests to AJAX endpoints with malformed parameters that induce server errors
Spikes in entries within iTop's IssueLog referencing exceptions triggered from AJAX rendering

Detection Strategies

Inspect web server access logs for authenticated sessions issuing high volumes of ajax.render.php requests with 200-status responses containing error keywords
Compare response bodies from AJAX endpoints against expected JSON or HTML fragment structures to flag exception leakage
Correlate spikes in application-side IssueLog errors with the source user account and IP for behavioral anomaly review

Monitoring Recommendations

Forward iTop application logs and web server access logs to a centralized SIEM for query and correlation
Alert when authenticated iTop users generate anomalous rates of server-side exceptions
Track outbound response sizes on ajax.render.php for statistical outliers indicative of verbose error output

How to Mitigate CVE-2026-33333

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which contains the official fix
Audit iTop user accounts and revoke unnecessary access to limit the population of users able to trigger AJAX endpoints
Review recent iTop logs for repeated exception events that may indicate prior reconnaissance

Patch Information

The fix is delivered in Combodo iTop 3.2.3. The upstream patch is committed as 170014e and documented in the GitHub Security Advisory GHSA-ghr8-5898-6rjh. The change replaces the echoed exception message with the localized UI:PageTitle:FatalError dictionary entry and preserves full detail in server-side logs.

Workarounds

Configure PHP with display_errors=Off and log_errors=On at the runtime level to reduce error leakage
Place iTop behind a web application firewall rule that strips or masks response bodies containing PHP exception signatures
Restrict access to the iTop interface to trusted networks or VPN-connected users until patching is complete

bash

# php.ini hardening to suppress verbose error output
display_errors = Off
display_startup_errors = Off
log_errors = On
error_log = /var/log/php/error.log
expose_php = Off