CVE-2026-27463: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in Combodo iTop

Combodo iTop versions before 3.2.3 contain an information disclosure vulnerability (CWE-200) where the full software version is exposed in the HTML title attribute of the logo on the login page. This exposure could potentially assist unauthorized actors in reconnaissance activities by revealing the exact version of iTop in use. The vulnerability does not require privileges or user interaction to be observed. The issue was resolved by removing or obfuscating the version information in the login page's HTML title attribute starting with version 3.2.3.

The vulnerability allows unauthorized actors to obtain the exact version of the iTop software deployed by viewing the login page source. This information disclosure is limited to version enumeration and does not directly compromise data confidentiality, integrity, or availability. However, it may facilitate targeted attacks if other vulnerabilities exist in the disclosed version.

Upgrade to Combodo iTop version 3.2.3 or later, where this information disclosure issue has been fixed. No other mitigation is required as the vendor has addressed the exposure in the specified version.