Live › vulnerability › CVE-2026-113694
BMC IT Service Management Suite's SmartIT user attachment feature fails to check authorization, so a logged-in user can open or change attachments that belong to other users. The sources rate it medium (CVSS 5.3).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Organisations running BMC IT Service Management Suite with the SmartIT feature in the listed versions. Exposure requires a valid user account, since the flaw is an authenticated authorization bypass on attachments. Installations on other versions are not named in the sources.
No product ranges from the sources yet.
25.3.01, 25.4.01, and 26.1.01.25.3.01, 25.4.01, 26.1.01; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-113694")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.