CVE Feed

    Dashboard / CVE / CVE-2026-113694

    CVE-2026-113694

    Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

    Published:Oct 29, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 29, 2026
    EPSS Score:0.00308
    CVSS Score:5.3

    Affected Products

    Vendor
    Bmc
    Product
    Bmc It Service Management Suite

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-285 Improper Authorization

    Related CVEs

    CVE-2026-113696 (CVSS 5.3) — Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113695 (CVSS 4.8) — Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Sui…
    CVE-2026-113693 (CVSS 5.3) — Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite ve…
    CVE-2026-113692 (CVSS 6.9) — Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.…
    CVE-2026-113691 (CVSS 5.1) — Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versio…
    CVE-2026-113690 (CVSS 4.8) — Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113689 (CVSS 5.1) — Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113688 (CVSS 5.3) — Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite ver…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High