CVE-2026-30890: Combodo iTop Reflected XSS Vulnerability

CVE-2026-30890 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage configuration items, incidents, and IT operations. CVE-2026-30890 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the synchro_import script. The flaw stems from unsanitized handling of the data_source_id query parameter. Authenticated attackers can craft a malicious link that, when opened by a victim, executes arbitrary JavaScript in the victim's browser session. The issue affects versions prior to 3.2.3 and is fixed in version 3.2.3.

Critical Impact

Successful exploitation allows attackers to execute arbitrary script in an authenticated iTop user's browser, potentially leading to session hijacking, credential theft, or unauthorized ITSM actions.

Affected Products

• Combodo iTop versions prior to 3.2.3
• synchro/synchro_import.php script
• iTop data synchronization component

Discovery Timeline

• 2026-08-21 - CVE-2026-30890 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-30890

Vulnerability Analysis

The vulnerability resides in the synchro_import.php script, which processes data synchronization requests. The script reads the data_source_id parameter from user input using the raw_data sanitization mode. This mode does not enforce integer typing or HTML encoding, allowing arbitrary strings to pass through. The value is then reflected in the response context without escaping.

An attacker with a valid iTop account can craft a URL containing JavaScript payloads in the data_source_id parameter. When a victim clicks the link, the payload executes in the victim's authenticated session. Attackers can steal session cookies, invoke privileged ITSM operations, or pivot to other application functionality.

Root Cause

The root cause is improper input validation. The ReadMandatoryParam call requested the data_source_id parameter as raw_data, bypassing type coercion. Since data_source_id is semantically an integer, using the raw_data filter permitted script content to reach output rendering.

Attack Vector

Exploitation requires network access to the iTop instance, low-privilege authentication, and user interaction (clicking a crafted link). The attack targets the confidentiality, integrity, and availability of the victim's session and iTop data.

	//
	// Read parameters
	//
-	$iDataSourceId = ReadMandatoryParam($oP, 'data_source_id', 'raw_data');
+	$iDataSourceId = ReadMandatoryParam($oP, 'data_source_id', utils::ENUM_SANITIZATION_FILTER_INTEGER);
	$sSynchronize = ReadParam($oP, 'synchronize');
	$sSep = ReadParam($oP, 'separator', 'raw_data');
	$sQualifier = ReadParam($oP, 'qualifier', 'raw_data');

Source: Combodo iTop commit 9236449. The patch replaces the raw_data filter with utils::ENUM_SANITIZATION_FILTER_INTEGER, forcing the parameter to a safe integer value before use.

Detection Methods for CVE-2026-30890

Indicators of Compromise

• Requests to synchro/synchro_import.php containing script tags, event handlers, or JavaScript URI schemes in the data_source_id parameter.
• URL-encoded payloads such as %3Cscript%3E or javascript: appearing in data_source_id query strings within web server logs.
• Unexpected outbound requests from user browsers following visits to iTop synchro import URLs.

Detection Strategies

• Inspect HTTP access logs for synchro_import requests where data_source_id contains non-numeric characters.
• Deploy web application firewall (WAF) rules that block reflected XSS patterns targeting iTop endpoints.
• Correlate iTop authentication events with anomalous parameter values to identify targeted phishing attempts against ITSM users.

Monitoring Recommendations

• Monitor iTop application logs for parameter validation errors and abnormal synchro_import invocations.
• Alert on iTop user sessions performing unusual object modifications shortly after opening external links.
• Track user-agent and referer headers on synchro_import requests to detect cross-origin abuse.

How to Mitigate CVE-2026-30890

Immediate Actions Required

• Upgrade Combodo iTop to version 3.2.3 or later, which enforces integer sanitization on data_source_id.
• Audit user accounts with access to synchronization features and revoke unnecessary privileges.
• Educate iTop administrators and users about phishing links referencing internal ITSM URLs.

Patch Information

The fix is available in Combodo iTop 3.2.3. Review the GitHub Security Advisory GHSA-93q9-fc8m-5gp5 and the upstream commit that applies utils::ENUM_SANITIZATION_FILTER_INTEGER to the data_source_id parameter.

Workarounds

• Restrict access to synchro/synchro_import.php at the reverse proxy or WAF until patching is complete.
• Enforce a strict Content Security Policy (CSP) that blocks inline scripts and untrusted script sources.
• Require re-authentication for synchro import operations to limit session reuse via crafted links.

# Example WAF rule blocking script payloads in data_source_id
# ModSecurity rule (illustrative)
SecRule ARGS:data_source_id "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1030890,phase:2,deny,status:403,log,msg:'CVE-2026-30890 iTop synchro_import XSS attempt'"