CVE-2026-31803

The CVSS 8 for this reflected XSS in iTop's tagadmin.php makes sense only if you're accounting for what an admin session actually provides: direct access to the CMDB, which is a comprehensive map of infrastructure topology, service dependencies, and often integration credentials for connected systems. That's the real blast radius the score doesn't capture — an attacker compromising an admin account via a phishing link doesn't need to escalate further within iTop; they've already won the reconnaissance phase for the entire connected environment. The patch in 3.2.3 was almost certainly a localized htmlspecialchars() call on a single parameter. That pattern is the tell. Combodo found the symptom, patched it, and moved on — there's no evidence of systemic output encoding hardening or Content Security Policy deployment. This matters because ITSM frameworks built on PHP have a documented history of exactly this localized fix pattern, and the evidence suggests it produces false closure: organizations patch tagadmin.php and stop auditing, while tag-adjacent endpoints (tag-based search, tag categorization, tag inheritance) go unexamined. The privilege question matters operationally. If tagadmin.php is behind a VPN or IP restriction, the phishing bar is higher. But iTop increasingly deploys with SAML or OIDC federation, which means the admin interface may be accessible from anywhere — a reflected XSS in an admin page becomes a credential theft vector that bypasses perimeter assumptions. The timeline is worth flagging for defenders: if 3.2.3 bundled this fix with non-security changes, organizations with rigorous change management may have deferred the update. The effective exposure window is likely longer than the patch date suggests.

Reviewed through automated stages and approved by a human before publication.