Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-21T22:16:36.717Z",
  "pubdate": "2026-08-21T22:16:36.717Z",
  "executiveSummary": "Combodo iTop prior to version 3.2.3 suffers from an access control vulnerability that permits an unprivileged or improperly authorized user to acquire a lock on specific system objects.\nThis vulnerability specifically impacts the object management and concurrency control mechanisms within the Combodo iTop web-based IT service management platform.\nThe primary risk implication is unauthorized resource monopolization, where malicious or inadvertent users lacking standard write permissions can arbitrarily lock objects, thereby disrupting administrative workflows, denying legitimate updates, and causing operational bottlenecks within the IT service management infrastructure.\nExploitation of this flaw requires an authenticated user context where the attacker possesses read or general interaction capabilities but lacks the explicit write permissions normally mandated for administrative or modifying actions on the targeted records.\nThe vulnerability allows unauthorized actors to bypass role-based access control (RBAC) enforcement specifically tied to the state-locking mechanism, highlighting a discrepancy between authorization checks for data modification versus data locking operations within the application logic.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization bypass or missing permission validation check within the object locking subsystem of Combodo iTop prior to version 3.2.3.\nWhen a user attempts to lock an object to prevent concurrent modifications, the application fails to adequately verify whether the requesting user possesses the requisite write permissions for the specific target object.\nThe vulnerable component resides within the access control and concurrency management logic responsible for evaluating user roles and permissions prior to granting state locks on database records or application objects.\nAffected versions include all Combodo iTop deployments prior to version 3.2.3.\nThe attack flow proceeds as follows: an authenticated user with low-level privileges (such as a standard read-only user or a role lacking write access) navigates to a target object within the iTop interface. The user initiates a lock action on the object via the application UI or by directly crafting an API request directed at the locking endpoint. Because the underlying controller or authorization middleware improperly validates write permissions during the lock acquisition phase, the application processes the request and applies the lock to the object. Consequently, authorized administrators or users with legitimate write permissions are blocked from modifying the locked object, resulting in a localized denial of service or workflow obstruction.\nAuthentication is required to interact with the target objects, but the vulnerability can be exploited by principals lacking the specific privilege level normally enforced for write operations.\nPost-exploitation impact includes persistent workflow disruption, unauthorized denial of critical IT service management updates, and potential operational paralysis of dependent change and incident management processes."
}