CVE-2026-113696
CVE-2026-113696 · Improper Authorization in BMC ITSM SmartIT Change Approvals
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
bmc it service management suite
- Versions
- 25.3.01: Affected (custom)
- 25.3.01 hotfix 10: Not affected (custom)
- 25.4.01: Affected (custom)
- 25.4.01 hotfix 22: Not affected (custom)
- 26.1.01: Affected (custom)
- 26.1.01 hotfix 12: Not affected (custom)
Update to 25.4.01 hotfix 22; Update to 26.1.01 hotfix 12
Original sources
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
- https://nvd.nist.gov/vuln/detail/CVE-2026-113696