Combodo iTop CVE-2026-30826

Exploitation requires that the attacker holds a valid iTop account with sufficient privileges to access the OQL query testing page (PR:L per CVSS vector), and that a target user with equal or higher privileges clicks an attacker-crafted URL while authenticated to the same iTop instance (UI:R per CVSS vector). The OQL query testing feature (pages/run_query.php) must be reachable by the attacker's account. What limits exploitation: user interaction is mandatory - passive browsing is not sufficient; the attacker must themselves be an authenticated iTop user; and the victim must follow the malicious link during an active session. No special non-default server configuration is required beyond a standard iTop installation once the attacker has a valid account.

The CVSS 8.0 score with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H reflects a network-exploitable, low-complexity reflected XSS requiring that the attacker hold a valid iTop account (PR:L) and that a victim user click an attacker-crafted link while authenticated (UI:R). These conditions meaningfully limit opportunistic mass exploitation - this is not a fire-and-forget unauthenticated attack. The high C/I/A scores are plausible for an ITSM platform where compromising an administrator's session yields control over IT infrastructure records, change tickets, and configuration data; however, the A:H rating is debatable for a reflected XSS where direct availability impact is not a primary vector. No EPSS data, CISA KEV listing, or public proof-of-concept exploit was present in the intelligence sources, indicating no confirmed active exploitation and suggesting this has not yet attracted broad attacker attention. Organizations running multi-user iTop deployments with privileged administrators who use the OQL query testing feature should treat this as a moderate-to-high priority patch.

An authenticated iTop user with access to the OQL query testing page crafts a malicious URL pointing to run_query.php with a query parameter that injects JavaScript into the $sAfter expression segment. The attacker delivers this URL to a higher-privileged iTop user (such as a system administrator); when that user clicks the link while logged into iTop, the injected script executes in their browser, enabling session token exfiltration, credential harvesting, or unauthorized ITSM actions performed under the victim's identity.