Reviewer content lock via unchecked authorization

Improper privilege management in CrafterCMS 3.1 through 3.1.17 allows remote authenticated users with a Reviewer role to lock content items. Crafter Studio accepts the lock operation without enforcing the intended privilege boundary for that role; the vendor does not publish a more specific endpoint or code locus. Reviewer credentials and access to the authenticated Studio interface are required, and the documented consequence is unauthorized content-item locking rather than data disclosure or code execution.