CVE-2026-30866: Combodo iTop Information Disclosure Flaw

CVE-2026-30866 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, changes, and configuration items. CVE-2026-30866 is an information disclosure vulnerability affecting iTop versions prior to 3.2.3. Unauthenticated attackers who obtain or sniff a valid document URL can retrieve uploaded sensitive files without providing credentials. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is addressed in iTop 3.2.3.

Critical Impact
Remote, unauthenticated attackers can download uploaded documents from vulnerable iTop instances by replaying or sniffing document URLs, exposing confidential ITSM attachments.

Affected Products

Combodo iTop versions prior to 3.2.3
The pages/ajax.document.php inline image and document endpoint
iTop deployments exposing document URLs over unencrypted or shared channels

Discovery Timeline

2026-08-21 - CVE-2026-30866 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-30866

Vulnerability Analysis

The vulnerability resides in iTop's document delivery endpoint, which served uploaded files without enforcing an authenticated session. When a user uploaded an image or attachment, the returned URL could be retrieved by anyone with network visibility to the request. Attackers observing HTTP traffic, log files, referer headers, or proxy caches could replay these URLs to download the underlying documents. Because iTop stores ITSM artifacts such as incident attachments, configuration diagrams, and change records, the exposed data can include internal architecture details and credentials embedded in uploaded content. The issue is scoped to confidentiality; integrity and availability are not directly affected.

Root Cause

The root cause is missing authentication on the document delivery path in pages/ajax.document.php. The endpoint issued file responses based on URL parameters alone and did not require an active login session. Any request presenting a valid document identifier received the file contents, regardless of authentication state.

Attack Vector

Exploitation requires network access to a vulnerable iTop instance and knowledge of a document URL. Attackers can obtain URLs from network sniffing, browser history, email quotes, ticket exports, referer leakage to third-party sites, or web server logs. No user interaction or privileges are required once a URL is known.

php

// Security patch in pages/ajax.document.php
// Source: https://github.com/Combodo/iTop/commit/458a996c29db73b9ce2d374f6ce8b90c36351159

	require_once(APPROOT.'/application/startup.inc.php');

	require_once(APPROOT.'/application/loginwebpage.class.inc.php');
-	LoginWebPage::DoLoginEx();

	IssueLog::Trace('----- Request: '.utils::GetRequestUri(), LogChannels::WEB_REQUEST);

The diff shows that the fix restores the LoginWebPage::DoLoginEx() call, forcing authentication before the endpoint serves any document. See the Combodo iTop commit 458a996 for the full patch.

Detection Methods for CVE-2026-30866

Indicators of Compromise

Web server access logs showing successful 200 responses to pages/ajax.document.php requests from unauthenticated sessions or unknown source IPs
Repeated requests to document URLs from IP addresses that never authenticated to iTop
Anomalous spikes in ajax.document.php traffic outside normal business hours

Detection Strategies

Correlate iTop application logs with web server logs to identify document requests lacking a preceding authenticated session cookie
Inspect HTTP traffic for document URLs traversing unencrypted channels or being forwarded via email and third-party services
Review referer headers in outbound proxy logs to detect iTop document URLs leaking to external destinations

Monitoring Recommendations

Alert on any access to pages/ajax.document.php where the request lacks a valid iTop session identifier
Monitor for bulk enumeration patterns against document endpoints, such as sequential identifier scanning
Track downloads of sensitive attachments and compare against user activity baselines

How to Mitigate CVE-2026-30866

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later, which enforces authentication on the affected endpoint
Rotate any credentials, tokens, or secrets that may have been stored inside uploaded iTop documents
Audit web server and proxy logs for prior unauthenticated access to pages/ajax.document.php

Patch Information

Combodo released the fix as part of iTop 3.2.3. The patch reintroduces LoginWebPage::DoLoginEx() in pages/ajax.document.php, requiring an authenticated session before document delivery. Full details are available in the GitHub Security Advisory GHSA-8rgc-qjf3-xqq4 and the upstream commit.

Workarounds

Restrict access to iTop behind a VPN or IP allowlist until the upgrade to 3.2.3 is completed
Place a reverse proxy or web application firewall (WAF) rule in front of pages/ajax.document.php requiring a valid iTop session cookie
Enforce HTTPS across all iTop traffic to reduce URL exposure from passive network sniffing

bash

# Example nginx rule to block unauthenticated document access
location /pages/ajax.document.php {
    if ($cookie_itop_auth = "") {
        return 403;
    }
    proxy_pass http://itop_backend;
}