CVE-2026-27462: Combodo iTop: User enumeration via password reset
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Combodo iTopto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the password-reset mechanism because the affected system returns distinguishable responses for valid and invalid usernames.
Which deployments are affected?
Combodo iTop versions prior to 3.2.3 are affected. The provided information does not identify any configuration prerequisite beyond use of the password-reset mechanism.
What is the impact of successful exploitation?
An attacker can enumerate valid usernames by observing password-reset responses. The supplied information does not indicate direct password disclosure, account takeover, integrity impact, or availability impact.
How should this be remediated?
Upgrade Combodo iTop to version 3.2.3, where the issue is fixed.