---
id: "CVE-2026-113694"
kind: "vulnerability"
aliases: ["CVE-2026-113694"]
title: "BMC ITSM Suite: SmartIT attachments readable and editable across user accounts"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bmc-itsm", "itsm", "other", "smartit"]
not_affected_if: ["no-smartit-attachments", "unaffected-version"]
published_at: "2026-10-29T14:17:44+00:00"
first_seen_at: "2026-10-29T14:25:22+00:00"
updated_at: "2026-10-29T14:26:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113694", "first_seen_at": "2026-10-29T14:25:22+00:00"}]
---

# BMC ITSM Suite: SmartIT attachments readable and editable across user accounts

BMC IT Service Management Suite's SmartIT user attachment feature fails to check authorization, so a logged-in user can open or change attachments that belong to other users. The sources rate it medium (CVSS 5.3).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed BMC IT Service Management Suite version in the admin console or install files; affected versions are listed as `25.3.01`, `25.4.01`, and `26.1.01`.

## Fix

- Affected versions: `25.3.01`, `25.4.01`, `26.1.01`; the sources do not name the fixed version.

## Timeline

- 2026-10-29T14:25:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113694

## From the sources

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_