CVE-2026-30890 is a reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script of Combodo iTop, a web-based IT service management tool. Versions before 3.2.3 are affected. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity, with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability. The issue was fixed in version 3.2.3.

An attacker with low privileges who can trick a user into interacting with a crafted link or input can execute arbitrary scripts in the context of the affected iTop web application. This can lead to compromise of user sessions, data theft, or other malicious actions impacting confidentiality, integrity, and availability of the system.

Upgrade to Combodo iTop version 3.2.3 or later, where this reflected XSS vulnerability in the synchro import script has been fixed. No other mitigation guidance is provided, and patch status is confirmed by the vendor stating the fix is in version 3.2.3.