{"id":"CVE-2026-113694","kind":"vulnerability","aliases":["CVE-2026-113694"],"related":[],"title":"BMC ITSM Suite: SmartIT attachments readable and editable across user accounts","description":"Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.","summary":"BMC IT Service Management Suite's SmartIT user attachment feature fails to check authorization, so a logged-in user can open or change attachments that belong to other users. The sources rate it medium (CVSS 5.3).","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc-itsm","itsm","other","smartit"],"not_affected_if":["no-smartit-attachments","unaffected-version"],"how_to_check":"- Confirm the installed BMC IT Service Management Suite version in the admin console or install files; affected versions are listed as `25.3.01`, `25.4.01`, and `26.1.01`.","fix":"- Affected versions: `25.3.01`, `25.4.01`, `26.1.01`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-29T14:17:44+00:00","first_seen_at":"2026-10-29T14:25:22+00:00","triaged_at":"2026-10-29T14:26:10+00:00","updated_at":"2026-10-29T14:26:10+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T14:26:10Z","model":"claude-haiku-5-5","output":{"fix":"- Affected versions: `25.3.01`, `25.4.01`, `26.1.01`; the sources do not name the fixed version.","reach":"network","title":"BMC ITSM Suite: SmartIT attachments readable and editable across user accounts","impact":"medium","summary":"BMC IT Service Management Suite's SmartIT user attachment feature fails to check authorization, so a logged-in user can open or change attachments that belong to other users. The sources rate it medium (CVSS 5.3).","audience":"businesses","category":"other","nicknames":[],"who_cares":["bmc-itsm","smartit","itsm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other users' attachments read or modified by any logged-in user","analyst_note":"Find the fixed version and vendor advisory for BMC ITSM SmartIT attachments; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113694 lists no fix.","how_to_check":"- Confirm the installed BMC IT Service Management Suite version in the admin console or install files; affected versions are listed as `25.3.01`, `25.4.01`, and `26.1.01`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-smartit-attachments"],"who_is_affected":"Organisations running BMC IT Service Management Suite with the SmartIT feature in the listed versions. Exposure requires a valid user account, since the flaw is an authenticated authorization bypass on attachments. Installations on other versions are not named in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4110,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113694':14A,17A '-2026':13A,16A '25.3.01':76C '25.4.01':77C '26.1.01':79C '5.3':60B 'access':84C 'account':11A 'across':9A 'allow':80C 'attach':5A,32B,48B,67C,87C 'authent':81C 'author':37B,62C 'belong':50B,89C 'bmc':1A,19B,24B,70C 'bmc-itsm':18B 'chang':47B 'check':36B 'cve':12A,15A 'cvss':59B 'edit':8A 'fail':34B 'featur':33B,68C 'improp':61C 'itsm':2A,20B,21B 'log':41B 'logged-in':40B 'manag':27B,73C 'medium':58B 'modifi':86C 'open':45B 'rate':56B 'readabl':6A 'resourc':88C 'servic':26B,72C 'smartit':4A,23B,30B,65C 'sourc':55B 'suit':3A,28B,74C 'user':10A,31B,43B,53B,66C,82C,92C 'version':75C","nicknames":[],"mitigations":[],"who_affected":"Organisations running BMC IT Service Management Suite with the SmartIT feature in the listed versions. Exposure requires a valid user account, since the flaw is an authenticated authorization bypass on attachments. Installations on other versions are not named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"47237f96-ddbe-4467-a5ee-293a770beacd","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113694","severity":null,"published_at":"2026-10-29T14:17:44+00:00","modified_at":"2026-10-29T14:17:44+00:00","first_seen_at":"2026-10-29T14:25:22+00:00","fetched_at":"2026-10-29T14:25:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}