Improper Authorization in BMC IT Service Management Suite Change Approval Feature
CVE-2026-113696

5.3MEDIUM

Key Information:

Vendor

Bmc

Status
Bmc It Service Management Suite
Vendor
CVE Published:
29 October 2026

What is CVE-2026-113696?

The change approval feature of the BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 contains an improper authorization vulnerability. This flaw permits authenticated users to make unauthorized changes to the approval state, thereby circumventing the designed approval restrictions. This issue poses a significant risk as it can lead to unauthorized modifications within the IT management process, undermining the integrity and security of service management operations.

Affected Version(s)

BMC IT Service Management Suite 25.3.01

BMC IT Service Management Suite 25.4.01

BMC IT Service Management Suite 26.1.01

References

https://github.com/NCSC-Assess/Advisories/blob/main/advis...
https://docs.helixops.ai/bin/Service-Management/On-Premis...
https://docs.helixops.ai/bin/Service-Management/On-Premis...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Justin HOCQUEL, NCSC
.