CVE-2026-27462

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Combodo/iTop/commit/9fd0ffd84ee62c1c6ede8d30db5fa0305f11fd01
https://github.com/Combodo/iTop/security/advisories/GHSA-888g-gv33-xwwx

Configurations

No configuration.

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Combodo iTop es una herramienta de gestión de servicios de TI basada en web. Antes de la 3.2.3, iTop devuelve respuestas diferentes para nombres de usuario válidos/inválidos dependiendo de múltiples factores en el mecanismo de restablecimiento de contraseña, lo que lleva a la enumeración de usuarios. Este problema ha sido solucionado en la versión 3.2.3.

Information

Published : 2026-08-21 20:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-27462

Mitre link : CVE-2026-27462

CVE.ORG link : CVE-2026-27462

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-27462", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27462", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T17:37:12.741694Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Combodo", "product": "iTop", "versions": [{"status": "affected", "version": "< 3.2.3"}]}]}], "published": "2026-08-21T20:16:33.870", "references": [{"url": "https://github.com/Combodo/iTop/commit/9fd0ffd84ee62c1c6ede8d30db5fa0305f11fd01", "source": "security-advisories@github.com"}, {"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-888g-gv33-xwwx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3."}, {"lang": "es", "value": "Combodo iTop es una herramienta de gesti\u00f3n de servicios de TI basada en web. Antes de la 3.2.3, iTop devuelve respuestas diferentes para nombres de usuario v\u00e1lidos/inv\u00e1lidos dependiendo de m\u00faltiples factores en el mecanismo de restablecimiento de contrase\u00f1a, lo que lleva a la enumeraci\u00f3n de usuarios. Este problema ha sido solucionado en la versi\u00f3n 3.2.3."}], "lastModified": "2026-10-14T19:10:00.297", "sourceIdentifier": "security-advisories@github.com"}