CVE-2026-30864: Combodo iTop Dashboard XSS Vulnerability

CVE-2026-30864 Overview

CVE-2026-30864 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting Combodo iTop, a web-based IT service management (ITSM) tool. The flaw resides in the dashboard revert functionality of iTop versions prior to 3.2.3. An authenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Combodo addressed the issue in iTop version 3.2.3.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated iTop user, potentially leading to session hijacking, credential theft, or unauthorized actions within the ITSM platform.

Affected Products

Combodo iTop versions prior to 3.2.3
Dashboard revert functionality component
Web-based iTop deployments accessible over the network

Discovery Timeline

2026-08-24 - CVE-2026-30864 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-30864

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw within the dashboard revert feature of Combodo iTop. Reflected XSS occurs when user-supplied input is echoed back into an HTTP response without proper encoding or sanitization. In iTop, the dashboard revert operation processes parameters that are reflected into the rendered page, allowing an attacker to inject HTML or JavaScript payloads.

Successful exploitation executes attacker-controlled scripts under the victim's authenticated iTop session. Attackers can steal session cookies, perform actions on behalf of the victim, manipulate ITSM tickets, or pivot to internal reconnaissance. Because iTop is commonly used by IT operations and service desk personnel, compromised sessions may hold elevated privileges over configuration management databases (CMDB) and incident records.

Root Cause

The root cause is improper neutralization of user-controllable input in the dashboard revert code path. Input parameters supplied through the request are inserted into the response HTML without sufficient output encoding, allowing script content to be interpreted by the browser rather than rendered as literal text.

Attack Vector

Exploitation requires network access to the iTop application, low-privileged authentication, and user interaction. An attacker crafts a URL targeting the vulnerable dashboard revert endpoint with an embedded payload. The attacker then delivers the URL to a victim through phishing, chat, or an internal link. When the victim, already authenticated to iTop, follows the link, the injected script executes in their browser and interacts with iTop under their identity. The scope change indicates that the impact extends beyond the vulnerable component to the victim's browsing context. For technical details, see the GitHub Security Advisory GHSA-6pgv-3fcp-c5g2.

Detection Methods for CVE-2026-30864

Indicators of Compromise

HTTP requests to dashboard revert endpoints containing script tags, event handlers such as onerror= or onload=, or javascript: URI schemes in query parameters
Web server access logs showing URL-encoded payloads (for example %3Cscript%3E) targeting iTop dashboard routes
Unexpected outbound requests from authenticated iTop user sessions to attacker-controlled domains
Anomalous ITSM actions (ticket modifications, user changes) originating from legitimate accounts shortly after a suspicious link click

Detection Strategies

Deploy a Web Application Firewall (WAF) with rules that inspect query and body parameters for XSS payload patterns targeting iTop endpoints
Correlate email or chat gateway logs with iTop web logs to identify user-clicked links containing suspicious parameters
Review browser Content Security Policy (CSP) violation reports for blocked inline script executions on iTop pages

Monitoring Recommendations

Monitor authentication and session activity in iTop for concurrent sessions or geographic anomalies indicative of session token theft
Alert on HTTP responses from iTop that reflect encoded HTML metacharacters back to the client in dashboard contexts
Track privileged iTop account activity for high-risk operations following inbound URL clicks

How to Mitigate CVE-2026-30864

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which contains the official fix
Invalidate active iTop user sessions after upgrading to force re-authentication
Educate iTop users, especially privileged administrators, about the risk of clicking unsolicited links referencing the iTop portal

Patch Information

Combodo released the fix in iTop version 3.2.3. Administrators should apply the upgrade following the vendor's standard upgrade procedure. Reference the GitHub Security Advisory GHSA-6pgv-3fcp-c5g2 for full remediation details.

Workarounds

Restrict network access to iTop with allow-listed source IP ranges or VPN-only exposure to reduce phishing reach
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources for the iTop application
Configure a WAF rule to block requests to dashboard revert endpoints that contain HTML metacharacters or script keywords in parameters

bash

# Example WAF/ModSecurity rule fragment to block XSS payloads targeting iTop dashboards
SecRule REQUEST_URI "@contains /pages/UI.php" \
  "chain,id:1030864,phase:2,deny,status:403,msg:'Potential XSS targeting iTop dashboard revert (CVE-2026-30864)'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"