CVE-2026-113696 PUBLISHED

Improper Authorization in BMC ITSM SmartIT Change Approvals

Assigner: NCSC
Reserved: 20.10.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

An authenticated user can perform the attack remotely without additional user interaction.

Product Status

Vendor BMC
Product BMC IT Service Management Suite
Versions Default: unknown
  • Version 25.3.01 is affected
  • Version 25.3.01 hotfix 10 is unaffected
  • Version 25.4.01 is affected
  • Version 25.4.01 hotfix 22 is unaffected
  • Version 26.1.01 is affected
  • Version 26.1.01 hotfix 12 is unaffected

Solutions

Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.

Credits

  • Justin HOCQUEL, NCSC finder

References

Problem Types

  • CWE-285 Improper Authorization CWE