What is the CVSS score of CVE-2026-30864?

CVE-2026-30864 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Combodo iTop are affected by CVE-2026-30864?

Combodo iTop versions prior to 3.2.3 contain a reflected XSS vulnerability in the dashboard revert functionality that allows authenticated users to execute arbitrary JavaScript within the iTop…. A patch is available.

How to fix or mitigate CVE-2026-30864?

Within 24 hours, inventory all Combodo iTop deployments and confirm which systems run versions below 3.2.3. Within 7 days, restrict dashboard revert functionality access to essential personnel only, implement strict input validation and output encoding on the revert feature, and deploy Content Security Policy (CSP) headers to block inline script execution. Within 30 days, monitor Combodo security advisories for the release of patch version 3.2.3 or later, conduct testing in a non-production environment, and deploy the patch to all affected instances immediately upon validation.

Combodo iTop CVE-2026-30864

EUVD-2026-65074 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-24 GitHub_M

XSS Itop

8.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.9 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

vuln.today AI

8.9 HIGH

Network-accessible web app (AV:N/AC:L); valid account required (PR:L); victim must click crafted link (UI:R); XSS executes in browser scope beyond iTop (S:C); session theft enables high C/I, minimal availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 24, 2026 - 20:01 EUVD

Analysis Generated

Aug 24, 2026 - 19:40 vuln.today

CVE Published

Aug 24, 2026 - 18:52 cve.org

HIGH 8.9

DescriptionCVE.org

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

AnalysisAI

Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold a valid iTop user account (PR:L per the CVSS vector) and to successfully induce a target user to click a crafted link (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.9 score is driven primarily by the Changed scope and high Confidentiality/Integrity impact ratings, which accurately reflect the potential for session token theft and unauthorized action execution in a victim's browser. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Combodo iTop to version 3.2.3 or later, as confirmed by vendor advisory GHSA-6pgv-3fcp-c5g2 at https://github.com/Combodo/iTop/security/advisories/GHSA-6pgv-3fcp-c5g2. … Detailed patch versions, workarounds, and compensating controls in full report.