Combodo iTop CVE-2026-30819

Exploitation requires a valid iTop user session with at least low-privilege access, confirmed by PR:L in the CVSS vector. The attack is specifically limited to the dashboard revert functionality in /pages/ajax.render.php - other endpoints are not affected by this parameter. User interaction is mandatory (UI:R per CVSS): the attacker must socially engineer a victim into clicking a crafted URL; the attack cannot be triggered server-side or automatically. Exploitation is further limited to iTop deployments running any version prior to 3.2.3; no special server-side configuration beyond a standard iTop installation is required. What limits exploitation: the authenticated prerequisite rules out unauthenticated internet scanners, and the UI:R requirement prevents fully automated attack tooling from being effective at scale.

The provided CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) accurately characterizes this as a network-exploitable, low-complexity flaw with substantial confidentiality and integrity impact but constrained by two prerequisites: authenticated access (PR:L) and victim interaction (UI:R). EPSS data was not included in the available intelligence, so automated exploitation probability cannot be quantified. This CVE is not listed in CISA KEV, and no public exploit code has been identified, indicating no confirmed widespread exploitation. The PR:L gating is meaningful in an ITSM context - iTop commonly grants portal access to contractors or end users, so the attacker population is not negligible, but it is bounded. UI:R prevents fully automated attack chains. Real-world risk is moderate: the C:H/I:H impact creates high damage potential per successful exploitation, but the combination of authenticated access and required social engineering substantially limits opportunistic exploitation.

An attacker with a low-privilege iTop account crafts a URL targeting /pages/ajax.render.php that encodes a JavaScript payload - such as a cookie-exfiltration script - within the dashboard_id parameter, then delivers it to an iTop administrator via phishing email or chat message. When the administrator opens the link while logged into iTop, the script executes in their browser and forwards the session cookie to an attacker-controlled server, granting full administrative access to the iTop instance. No public proof-of-concept has been identified, but the fix's commit diff provides sufficient technical detail for a skilled analyst to reproduce the vulnerability.