What is the CVSS score of CVE-2026-30866?

CVE-2026-30866 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Combodo iTop are affected by CVE-2026-30866?

Combodo iTop versions prior to 3.2.3 allow unauthenticated remote download of uploaded documents through a missing authentication check in the ajax.document.php endpoint.. A patch is available.

How to fix or mitigate CVE-2026-30866?

Within 24 hours, inventory all iTop deployments and identify any systems running versions prior to 3.2.3. Within 7 days, apply the vendor-released patch to upgrade iTop to version 3.2.3 or later on all affected instances, testing in a non-production environment before production deployment. Within 30 days, review access logs for ajax.document.php (backfill 90 days minimum) to identify unauthorized document downloads, audit document repository contents for exposure of sensitive materials, and implement network-level access controls restricting iTop to authenticated users only.

Combodo iTop CVE-2026-30866

EUVD-2026-64066 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-21 GitHub_M

Authentication Bypass Itop

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint requires no authentication or user interaction; impact is read-only confidentiality loss with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 21, 2026 - 20:16 vuln.today

Analysis Generated

Aug 21, 2026 - 20:16 vuln.today

Patch available

Aug 21, 2026 - 20:02 EUVD

CVE Published

Aug 21, 2026 - 19:32 cve.org

HIGH 7.5

DescriptionCVE.org

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

AnalysisAI

Unauthenticated remote access to uploaded documents is possible in Combodo iTop versions prior to 3.2.3 due to a missing authentication check in the ajax.document.php endpoint. The commit diff confirms that LoginWebPage::DoLoginEx() was absent from critical code paths that serve uploaded files, allowing any network-reachable user who obtains a valid document URL to download sensitive content without credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires two conditions: network reachability to the iTop web application, and possession of a valid document URL. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: unauthenticated network exploitation with high confidentiality impact and no complexity barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Combodo iTop to version 3.2.3 or later, which contains the authentication fix applied in commit 458a996c29db73b9ce2d374f6ce8b90c36351159 (https://github.com/Combodo/iTop/commit/458a996c29db73b9ce2d374f6ce8b90c36351159). … Detailed patch versions, workarounds, and compensating controls in full report.