Combodo iTop allows any authenticated user who does not have write permissions to lock objects. This lock prevents other users from editing or accessing the object until it is released, which can disrupt normal business operations. The flaw is an access‑control weakness (CWE‑862) that results in a mild denial‑of‑service effect with a CVSS score of 4.3.

The issue exists in Combodo iTop versions prior to 3.2.3. Users running any older version of the iTop web application are potentially impacted.

The CVSS base score of 4.3 indicates moderate severity. Because the flaw is exploitable by any authenticated user and no EPSS data is available, the likelihood of exploitation is uncertain but could be moderate if an attacker can obtain legitimate credentials. The vulnerability is not listed in the CISA KEV catalog, so no known large‑scale exploitation is reported. Attackers would need only to log into the application and click the lock function on any object they view, without needing to change roles or permissions.