CVE-2026-113694: Improper Authorization in BMC ITSM SmartIT Attachments
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a SmartIT user. The issue allows such users to access or modify attachment resources that belong to other users.
Which deployments are identified as affected?
The affected versions listed are BMC IT Service Management Suite 25.3.01, 25.4.01, and 26.1.01. The provided information does not state whether any particular default configuration changes exposure.
What is the likely impact if exploited?
An authenticated user may read attachments belonging to other users or alter those attachment resources. The supplied severity data rates the issue medium, with impacts to confidentiality and integrity but not availability.