CVE-2026-113696: Improper Authorization in BMC ITSM SmartIT Change Approvals
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Frequently Asked Questions
Which environments are exposed?
BMC IT Service Management Suite deployments running versions 25.3.01, 25.4.01, or 26.1.01 are affected where the SmartIT change approval feature is in use.
What access does an attacker need?
An attacker must be authenticated. The supplied vector indicates exploitation is network-accessible, requires low attack complexity, and does not require user interaction.
What is the expected impact of exploitation?
An authenticated attacker can alter approval state without authorization and bypass intended approval restrictions. The supplied severity data indicates limited integrity impact, with no stated confidentiality or availability impact.