Combodo iTop is a web‑based IT service management tool. Prior to version 3.2.3, the system executed Object Query Language (OQL) statements without enforcing silo access checks on classes that appear only in JOIN clauses. The vulnerability, classified as CWE‑200, allows an attacker to craft OQL queries that join protected classes with classes that the attacker is permitted to view, thereby retrieving data from otherwise inaccessible classes. This results in unauthorized disclosure of potentially sensitive information without any indication of the data loss in normal operation.

The issue affects all instances of Combodo iTop running any version before 3.2.3. The fix is included in release 3.2.3 and later. Users deploying earlier releases are susceptible if they have been granted any role capable of executing OQL queries.

The CVSS score of 7.7 indicates a high severity vulnerability. The EPSS score is not available, but the absence from the CISA KEV catalog suggests no known widespread exploitation at this time. Attackers would need authenticated access to the iTop web interface and the ability to submit OQL queries. Once inside, they could construct join queries that bypass silo controls and read data from classes beyond their privilege level. The risk is significant for organizations relying on silo boundaries to protect sensitive data.