Combodo iTop CVE-2026-27462

The vulnerable endpoint is the publicly accessible forgot-password page (ForgotPwdGo() handler), reachable without authentication per the CVSS vector PR:N. No special configuration is required - the discrepancy exists in iTop's default password reset flow. Exploitation is constrained by: (1) the attacker must have network access to the iTop web interface (AV:N means internet-exposed instances are at highest risk; internal-only deployments are protected by network boundaries); (2) the attacker must supply candidate usernames or email addresses to test, typically via a wordlist or OSINT; (3) rate limiting or CAPTCHA, if deployed, reduces enumeration speed. No user interaction, elevated privilege, or non-default configuration is required to trigger the differential responses.

The vendor-assigned CVSS score of 7.5 (High) with C:H overstates the direct impact: this vulnerability discloses account existence, not passwords, session tokens, or sensitive business data. An independent assessment rates confidentiality impact as Low (C:L), producing a score closer to 5.3 (Medium), which better reflects the actual information exposed. The CVSS attack vector metrics (AV:N/AC:L/PR:N/UI:N) are accurate - the forgot-password endpoint is publicly accessible and trivially reachable. EPSS data was not provided in available intelligence, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The practical risk is downstream: enumerated accounts enable targeted credential stuffing, password spraying, or phishing. Organizations with iTop exposed to the internet face the highest realistic risk, while internal-only deployments have substantially reduced exposure due to limited attacker reach.

An unauthenticated attacker submits a wordlist of candidate email addresses to the iTop password-reset endpoint and compares the HTTP responses or rendered error messages to classify each as a valid-but-blocked account versus an unknown account. No public proof-of-concept code has been identified at time of analysis. With a compiled list of confirmed valid usernames, the attacker proceeds to targeted credential stuffing or spear-phishing against those accounts.