Reflected Cross-Site Scripting Vulnerability in Combodo iTop IT Service Management Tool
CVE-2026-30819

7.3HIGH

Key Information:

Vendor

Combodo

Status
Itop
Vendor
CVE Published:
21 August 2026

What is CVE-2026-30819?

Combodo iTop, a web-based IT service management tool, is susceptible to a reflected Cross-Site Scripting (XSS) issue within its dashboard revert functionality. This vulnerability arises from improper handling of the 'dashboard_id' parameter in the /pages/ajax.render.php file. Attackers can exploit this flaw to execute arbitrary scripts in a user's browser, potentially leading to the theft of sensitive information or session hijacking. The issue has been addressed in iTop version 3.2.3, emphasizing the need for users to update their installations to protect against such exploits.

Affected Version(s)

iTop < 3.2.3

References

https://github.com/Combodo/iTop/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/104dd1970f3ad82889...
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.