Combodo iTop CVE-2026-30865

The victim must be an active authenticated iTop session holder - the XSS is reflected through the dashboard save/reload mechanism which is only reachable by logged-in users, so unauthenticated visitors are not directly at risk. The attacker requires no privileges themselves (CVSS PR:N) but must socially engineer the authenticated victim into following a crafted URL (CVSS UI:R). No special non-default configuration of iTop is required; any deployment running a version prior to 3.2.3 with the dashboard feature accessible is vulnerable. Exploitation is limited by the need for victim interaction and the requirement that the target holds a live authenticated session at the moment of the click.

The CVSS 7.1 score is driven primarily by the Scope Changed flag (S:C), reflecting that XSS payloads can access cookies, session tokens, and actions across the iTop origin. The attack vector is network-accessible (AV:N) with low complexity (AC:L) and no attacker privileges required (PR:N), but mandatory user interaction (UI:R) constrains opportunistic mass exploitation - an attacker must deliver the malicious URL to an authenticated iTop user and induce a click. No CISA KEV listing exists, meaning active exploitation is unconfirmed. No public PoC has been identified. EPSS data was not provided, limiting probabilistic scoring. Real-world risk is moderate: reflected XSS in ITSM tooling is attractive for credential harvesting and lateral movement within IT teams, but the social-engineering prerequisite and the niche deployment footprint of iTop reduce blast radius compared to widely-deployed platforms. Internet-exposed iTop instances are higher priority for patching than intranet-only deployments.

An attacker crafts a URL targeting the iTop dashboard save endpoint (ajax.render.php) with a JavaScript payload embedded in the dashboard_id or reload_url parameter, then delivers it to an IT administrator via phishing email or instant message. When the authenticated administrator clicks the link, the payload is reflected in the server response and executed in their browser, allowing the attacker to steal the session token or submit privileged iTop actions on the administrator's behalf. No public PoC is known, but reflected XSS of this pattern requires only standard browser developer tools to construct.