CVE-2026-30819: Combodo iTop Dashboard XSS Vulnerability

CVE-2026-30819 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by enterprises to manage assets, incidents, and change requests. CVE-2026-30819 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting iTop versions prior to 3.2.3. The flaw resides in the dashboard revert functionality exposed through /pages/ajax.render.php, where the dashboard_id parameter is processed without proper sanitization. An authenticated attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session when clicked. Combodo addressed the issue in iTop 3.2.3.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated iTop user, enabling session hijacking, credential theft, and unauthorized ITSM actions.

Affected Products

Combodo iTop versions prior to 3.2.3
Component: pages/ajax.render.php (dashboard revert operation)
Fixed release: Combodo iTop 3.2.3

Discovery Timeline

2026-08-21 - CVE-2026-30819 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-30819

Vulnerability Analysis

The vulnerability is a reflected XSS in the AJAX handler responsible for the revert_dashboard operation. When iTop processes a request to revert a dashboard, it reads the dashboard_id HTTP parameter and reflects that value back into rendered content without applying a context-appropriate sanitization filter. An attacker who convinces an authenticated iTop user to visit a crafted link causes the browser to execute attacker-controlled script under the iTop origin.

Because iTop is used to manage IT service workflows, tickets, and configuration items, script execution in an authenticated administrator session can be leveraged to modify records, escalate privileges within the application, or exfiltrate sensitive ITSM data. Exploitation requires an authenticated session and user interaction with the malicious link.

Root Cause

The root cause is improper neutralization of input during web page generation. In the vulnerable code path, dashboard_id was read using the raw_data sanitization mode, which preserves the raw user-supplied string. That value then reached output contexts where HTML or JavaScript could be injected. The patch changes the sanitization filter to ENUM_SANITIZATION_FILTER_CONTEXT_PARAM, which enforces context-appropriate escaping for parameters embedded in page context.

Attack Vector

Exploitation occurs over the network against an authenticated user. The attacker crafts a URL to /pages/ajax.render.php with operation=revert_dashboard and a malicious dashboard_id payload containing JavaScript. Delivery typically relies on phishing or embedding the link in a trusted channel. When the victim follows the link, iTop reflects the payload and the browser executes it under the victim's session.

php

// Patch: pages/ajax.render.php - N°9230
// Sanitize dashboard_id parameter in "revert_dashboard" AJAX operation

			case 'revert_dashboard':
-				$sDashboardId = utils::ReadParam('dashboard_id', '', false, 'raw_data');
+				$sDashboardId = utils::ReadParam('dashboard_id', '', false, utils::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM);
				$sReloadURL = utils::ReadParam('reload_url', '', false, utils::ENUM_SANITIZATION_FILTER_URL);
				appUserPreferences::UnsetPref('display_original_dashboard_'.$sDashboardId);
				$oDashboard = new RuntimeDashboard($sDashboardId);

Source: GitHub Commit 104dd19. The fix replaces the permissive raw_data filter with a context-aware sanitization filter for the dashboard_id parameter.

Detection Methods for CVE-2026-30819

Indicators of Compromise

HTTP requests to /pages/ajax.render.php containing operation=revert_dashboard with dashboard_id values that include angle brackets, script, javascript:, or event handlers such as onerror.
URL-encoded or double-encoded payloads in the dashboard_id query string parameter targeting iTop hosts.
Referer headers from external or untrusted domains preceding requests to the dashboard revert endpoint.

Detection Strategies

Inspect web server and reverse-proxy logs for dashboard_id values that do not match expected dashboard identifier formats (typically numeric or alphanumeric strings).
Deploy WAF signatures for reflected XSS payloads on the /pages/ajax.render.php endpoint, focusing on the revert_dashboard operation.
Correlate suspicious dashboard_id requests with the authenticated user session to identify targeted accounts.

Monitoring Recommendations

Alert on outbound requests from iTop user browsers to unfamiliar domains shortly after visits to ajax.render.php, which may indicate script-driven data exfiltration.
Monitor iTop administrative actions performed immediately after dashboard revert requests to detect scripted abuse of privileged sessions.
Track the iTop version deployed across environments and flag any instance still running a release earlier than 3.2.3.

How to Mitigate CVE-2026-30819

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later, which contains the sanitization fix for the dashboard_id parameter.
Audit iTop user accounts, especially administrators, for anomalous activity following the CVE publication date.
Enforce Content Security Policy (CSP) headers on iTop deployments to reduce the impact of reflected script execution.

Patch Information

The issue is resolved in Combodo iTop 3.2.3. The upstream fix is available in GitHub Commit 104dd19 and is described in GitHub Security Advisory GHSA-gccc-8mw3-hqhp. Administrators should follow Combodo's standard upgrade procedure and validate customizations against the new release.

Workarounds

If immediate upgrade is not possible, restrict access to /pages/ajax.render.php behind a reverse proxy or WAF that blocks dashboard_id values containing HTML or JavaScript syntax.
Require re-authentication for sensitive iTop operations and shorten session timeouts to reduce the window for session-riding attacks.
Train iTop users to avoid following unsolicited links to internal ITSM URLs and enforce browser-side XSS protections where available.

bash

# Example WAF rule (ModSecurity) to block suspicious dashboard_id values
SecRule ARGS:dashboard_id "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "id:1030819,phase:2,deny,status:403,log,\
     msg:'CVE-2026-30819 iTop reflected XSS attempt in dashboard_id'"