The OQL testing functionality in Combodo iTop contains a reflected XSS vulnerability (CVE-2026-30826, CVSS 8) that warrants more attention than a standard admin-panel XSS would receive. The key distinction is context: this isn't a settings page where XSS yields session cookies. It's an interface where authenticated administrators construct and execute database queries. A successful XSS payload doesn't stop at session hijacking — it inherits the admin's implicit permissions to run arbitrary OQL against the database. The attack path compounds from browser-based theft to direct data manipulation through the same interface the victim is using.
The 3.2.3 patch applies output encoding, which fixes the immediate symptom. But the underlying architectural issue is that the OQL testing feature collapses two distinct security boundaries into one: authentication is treated as sufficient for both admin configuration and query execution. That's the real vulnerability — not just unencoded output, but a design that assumes authenticated context equals trusted input. If the testing interface required step-up authentication or operated in a separate privileged context, this XSS would have far narrower blast radius.
For defenders: prioritize this patch, but also audit for similar patterns in other internal/testing features. The 'internal only' label consistently creates security shortcuts — this CVE is evidence that attackers specifically target that assumption. Review whether your own threat modeling explicitly covers developer and QA tooling, or whether 'internal' has become an implicit exception to input-handling requirements. The compound risk here (XSS pivoting to database access through a testing interface) is likely reproducible elsewhere in the same ecosystem.