An unauthenticated user can delete the .readonly file that is created during the setup of Combodo iTop. Removing this file removes the write guard and permits the attacker to perform write operations against the application, potentially altering configuration, data, or inserting malicious content. The weakness is a classic authorization bypass and is categorized as CWE‑306.

Combodo iTop installations running any version prior to 3.2.3 are vulnerable. The issue was fixed in version 3.2.3, so any older deployment is at risk.

The CVSS score of 6.5 indicates a medium severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a simple HTTP request to the web interface that deletes the .readonly file; no authentication or elevated privileges are required, which makes exploitation straightforward for attackers with network access to the application.