Combodo iTop CVE-2026-30866

Exploitation requires two conditions: network reachability to the iTop web application, and possession of a valid document URL. The URL can be obtained through network sniffing of unencrypted HTTP traffic (the attack vector explicitly named in the CVE description), through server log exposure, HTTP Referer header leakage, or social engineering. No authentication is required and no non-default configuration is needed - any standard iTop deployment below 3.2.3 with uploaded documents is vulnerable. Exploitation is constrained by the requirement to obtain a valid document identifier; however, this is not a strong barrier in environments using HTTP rather than HTTPS. Attackers without a pre-obtained URL cannot blindly enumerate documents unless the identifier scheme is predictable.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: unauthenticated network exploitation with high confidentiality impact and no complexity barrier. However, practical risk is modulated by the need to obtain a valid document URL - exploitation is not fully opportunistic without URL knowledge, making mass exploitation less likely than targeted attacks. No EPSS score was included in the provided intelligence, and the CVE is not listed in CISA KEV, so widespread active exploitation is not confirmed. In enterprise ITSM deployments, uploaded documents frequently contain sensitive operational data such as contracts, incident reports, or credentials, meaning even a targeted attack against a single iTop instance carries meaningful business impact. The absence of integrity or availability impact aligns with read-only unauthorized file access. No conflicting signals exist between CVSS vector and description - both consistently indicate network-reachable unauthenticated read access.

An attacker with network access to an iTop instance operating over HTTP intercepts a document download request from a legitimate user, extracting the document URL from unencrypted traffic. The attacker then replays that URL as an unauthenticated HTTP GET request to ajax.document.php, successfully receiving the uploaded file - such as an incident report, contract, or configuration document - without presenting any credentials. No special tooling is required beyond standard HTTP client capabilities.