CVE-2026-33047 PUBLISHED

Combodo iTop: Object can be locked by a user without write permissions

Assigner: GitHub_M
Reserved: 17.03.2026 Published: 21.08.2026 Updated: 21.08.2026

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 4.3

Product Status

Vendor Combodo
Product iTop
Versions
  • Version < 3.2.3 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE