Improper Authorization in BMC IT Service Management Suite for User Attachments
CVE-2026-113694

5.3MEDIUM

Key Information:

Vendor

Bmc

Status
Bmc It Service Management Suite
Vendor
CVE Published:
29 October 2026

What is CVE-2026-113694?

The SmartIT user attachment feature in BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 contains an improper authorization flaw. This vulnerability allows authenticated users to gain unauthorized access to or modify attachments that belong to other users, potentially leading to data exposure and manipulation. Organizations using these versions should assess their exposure and apply necessary remediation measures.

Affected Version(s)

BMC IT Service Management Suite 25.3.01

BMC IT Service Management Suite 25.4.01

BMC IT Service Management Suite 26.1.01

References

https://github.com/NCSC-Assess/Advisories/blob/main/advis...
https://docs.helixops.ai/bin/Service-Management/On-Premis...
https://docs.helixops.ai/bin/Service-Management/On-Premis...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Justin HOCQUEL, NCSC
.