Combodo iTop CVE-2026-30864

Exploitation requires the attacker to hold a valid iTop user account (PR:L per the CVSS vector) and to successfully induce a target user to click a crafted link (UI:R). The vulnerability is located specifically in the dashboard revert functionality - no additional non-default configuration settings are required to trigger the vulnerable code path. Factors that limit exploitation include: the attacker must be a credentialed iTop user (eliminating fully external unauthenticated attackers), and the victim must actively interact with the malicious link (eliminating automated scanning or mass exploitation). The practical risk is highest when the attacker targets a high-privilege session, since the Changed scope means the injected payload operates within whatever permissions the victim holds.

The CVSS 8.9 score is driven primarily by the Changed scope and high Confidentiality/Integrity impact ratings, which accurately reflect the potential for session token theft and unauthorized action execution in a victim's browser. However, two mitigating factors meaningfully constrain real-world exploitability: PR:L requires the attacker to hold a valid iTop account, and UI:R requires the victim to interact with a crafted link. These conditions limit opportunistic, automated exploitation and elevate the social engineering burden. No EPSS data was supplied, no KEV listing exists, and no POC is known - all consistent with a vulnerability that has not yet attracted active exploitation. The practical risk is highest in deployments where iTop users hold privileged roles (ITSM administrators, change approvers) and where phishing or internal threat actors are plausible, as a single successful exploit against a high-privilege session could yield significant ITSM data access or unauthorized change approval. No signals conflict in this dataset, though the absence of EPSS prevents a quantitative exploitation-probability assessment.

An authenticated attacker with a low-privilege iTop account crafts a malicious URL targeting the dashboard revert endpoint with an embedded XSS payload, then delivers it to a victim holding a privileged iTop role via phishing or internal messaging. When the victim clicks the link, their browser reflects and executes the injected script, allowing the attacker to exfiltrate the victim's session token and impersonate them within iTop - potentially approving changes or accessing sensitive ITSM records. No public POC is known at time of analysis, but reflected XSS of this pattern is well-understood and reproducible from the CVE description alone.