CVE Feed

    Dashboard / CVE / CVE-2026-113696

    CVE-2026-113696

    Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

    Published:Oct 29, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 29, 2026
    EPSS Score:0.00402
    CVSS Score:5.3

    Affected Products

    Vendor
    Bmc
    Product
    Bmc It Service Management Suite

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-285 Improper Authorization

    Related CVEs

    CVE-2026-113695 (CVSS 4.8) — Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Sui…
    CVE-2026-113694 (CVSS 5.3) — Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113693 (CVSS 5.3) — Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite ve…
    CVE-2026-113692 (CVSS 6.9) — Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.…
    CVE-2026-113691 (CVSS 5.1) — Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versio…
    CVE-2026-113690 (CVSS 4.8) — Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113689 (CVSS 5.1) — Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113688 (CVSS 5.3) — Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite ver…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High