CVE-2026-33240: Combodo iTop XSS Vulnerability

CVE-2026-33240 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage configuration items, incidents, and change requests. CVE-2026-33240 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the foreign key search criteria API. An attacker can craft a malicious link that, when clicked by an authenticated user, executes attacker-controlled JavaScript in the victim's browser session. The issue affects iTop versions prior to 3.2.3 and is resolved in version 3.2.3.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's authenticated session, enabling session hijacking, credential theft, and unauthorized actions within the iTop application.

Affected Products

Combodo iTop versions prior to 3.2.3
Deployments exposing the foreign key search criteria API to end users
Web-based ITSM instances relying on the vulnerable UISearchFormForeignKeys component

Discovery Timeline

2026-08-21 - CVE-2026-33240 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-33240

Vulnerability Analysis

The vulnerability resides in the foreign key search criteria API implemented by UISearchFormForeignKeys in application/ui.searchformforeignkeys.class.inc.php. User-controlled input flows into HTML output rendered by the search form without adequate contextual encoding. An attacker crafts a URL containing a malicious payload targeting parameters consumed by the search form. When a victim with an active iTop session visits the link, the payload reflects back and executes in the browser under the application's origin.

Exploitation requires user interaction, but no privileges on the target application are required from the attacker. The resulting script runs with the victim's authentication context, allowing full-privilege actions in the ITSM console.

Root Cause

The root cause is insufficient output encoding of user-supplied values passed to the foreign key search UI. Related client-side code in js/pages/backoffice/toolbox.js accepted DOM identifiers from user data without validating whether the id field was defined. Combined, these issues permitted attacker-controlled markup and script to be injected into the rendered page.

Attack Vector

The attack vector is network-based and requires the victim to click a crafted URL. Since iTop is commonly deployed for internal IT support staff, phishing emails targeting help desk operators are a realistic delivery mechanism. Because impact spans confidentiality, integrity, and availability, an attacker can pivot from XSS to session theft, unauthorized ticket modification, or lateral movement within the ITSM workflow.

php

// Security patch excerpt from application/ui.searchformforeignkeys.class.inc.php
class UISearchFormForeignKeys
{
    private $m_sRemoteClass;
    private $m_iInputId;

    public function __construct($sTargetClass, $iInputId = null)
    {
        $this->m_sRemoteClass = $sTargetClass;
        // ... remainder of constructor
    }
}

Source: GitHub commit 2a16143

javascript

// Client-side hardening in js/pages/backoffice/toolbox.js
class: typeof(element.classes) !== 'undefined' ? element.classes.join(' ') : '',
click: element.callback_on_click
}

// id is optional, and we don't want to set it if not defined
if (typeof element.id !== 'undefined' && element.id !== null) {
    aButton.id = element.id;
}

aConverted.push(aButton);

Source: GitHub commit 2a16143

Detection Methods for CVE-2026-33240

Indicators of Compromise

HTTP requests to iTop endpoints containing <script>, onerror=, onload=, or URL-encoded equivalents in foreign key search parameters
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading iTop pages
Anomalous session token usage from geographies or user agents that do not match the legitimate iTop user

Detection Strategies

Inspect web server and reverse proxy logs for query strings targeting the foreign key search API with reflected HTML or script fragments
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from iTop pages
Correlate iTop authentication events with unusual API activity indicative of session hijack following XSS execution

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS payload patterns against iTop URIs
Monitor iTop application logs for administrative or configuration item (CI) changes performed outside normal maintenance windows
Track browser referrers landing on iTop from external mail or chat platforms, which may indicate phishing-driven exploitation

How to Mitigate CVE-2026-33240

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later without delay
Invalidate active sessions after upgrade to force reauthentication and revoke any tokens potentially harvested via XSS
Educate iTop users to avoid clicking untrusted links that reference internal ITSM URLs

Patch Information

Combodo released the fix in iTop 3.2.3. The patch modernizes the search foreign keys code, tightens client-side DOM handling in js/pages/backoffice/toolbox.js, and encapsulates state within UISearchFormForeignKeys. Review the GitHub Security Advisory GHSA-5hw5-fvw4-55p4 and the upstream commit for the complete change set.

Workarounds

Restrict access to the iTop web console to trusted networks or VPN users until the patch is applied
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit XSS impact
Configure a WAF to block requests containing script tags or common XSS vectors targeting foreign key search endpoints

bash

# Example nginx configuration adding a restrictive CSP for iTop
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;