What is CVE-2026-27462?

CVE-2026-27462 is a high-severity vulnerability in Combodo Itop, classified under Observable Response Discrepancy. CVSS score: 7.5/10. Published 2026-08-21.

How severe is CVE-2026-27462?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Combodo Itop

CVE-2026-27462

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Combodo Itop — versions < 3.2.3

Weakness classification (CWE)

CWE-204 — Observable Response Discrepancy

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-27462?: CVE-2026-27462 is a high-severity vulnerability in Combodo Itop, classified under Observable Response Discrepancy. CVSS score: 7.5/10. Published 2026-08-21.
How severe is CVE-2026-27462?: High severity. CVSS v3 base score is 7.5 out of 10.