Combodo iTop CVE-2026-31880

Exploitation requires that the attacker possesses at least a low-privilege authenticated iTop account (CVSS PR:L confirms authentication is required - this is not unauthenticated). Additionally, a separately authenticated victim user must be induced to follow a crafted URL targeting UniversalSearch.php (CVSS UI:R). The universal search feature must be accessible to both parties. Exploitation is constrained by: (1) the attacker's need for their own valid iTop credentials, (2) mandatory victim interaction with a crafted link rather than passive drive-by, and (3) script execution scope limited to the iTop web application session - there is no browser escape or host-level impact indicated. There is no evidence of exploitation against default unauthenticated configurations.

The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) captures a network-accessible, low-complexity flaw but with two meaningful friction points: the attacker must hold valid low-privilege credentials (PR:L), and a victim must follow a crafted URL while authenticated (UI:R). These prerequisites meaningfully reduce opportunistic mass exploitation compared to unauthenticated self-executing vulnerabilities. No EPSS data was provided in the input, and the absence of a CISA KEV listing and confirmed public PoC further suggests this has not seen widespread in-the-wild exploitation at time of analysis. However, the high C/I/A ratings are well-justified in the ITSM context: a successful attack against an administrator's session can expose service tickets, infrastructure configurations, and credentials, enabling lateral movement into managed IT systems. Organizations that expose iTop directly to the internet rather than restricting it to an intranet or VPN face meaningfully elevated risk and should prioritize the 3.2.3 upgrade.

An attacker with a low-privilege iTop account crafts a universal search URL containing a JavaScript payload embedded in the OQL filter parameter and delivers it to a higher-privileged user (e.g., an iTop administrator) via phishing or a compromised internal communication channel. When the victim clicks the link while authenticated, the injected script executes in their browser session, allowing the attacker to exfiltrate session cookies or silently perform administrative actions within iTop. No confirmed public PoC exploit code exists at time of analysis, but the fix diff makes the injection point straightforward to identify.