Executive brief
Combodo iTop is a web-based IT service management platform used by organizations to track and manage IT assets and services. A vulnerability allows users without write permissions to lock objects in the system, preventing legitimate administrators from making critical updates. This could disrupt business operations and enable unauthorized interference with IT infrastructure records.
Technical details
The vulnerability is an access control bypass in the object locking mechanism. Prior to version 3.2.3, the application did not validate user permissions before acquiring locks on objects; a user with read-only or limited access could invoke the locking function via the AJAX endpoint in pages/ajax.render.php. The attack requires network access and authentication (low privilege account), but no user interaction. An attacker can lock objects indefinitely, causing availability degradation and blocking legitimate write operations. The fix adds permission checks before lock acquisition.
Affected products
- Combodo iTop prior to 3.2.3
Timeline
- 2026-08-10: disclosed
- 2026-08-21: patched: version 3.2.3 and 3.3.0 released