Live › vulnerability › CVE-2026-113696
BMC IT Service Management Suite's SmartIT change approval feature does not check authorization properly. A logged-in user can change approval state and get around intended approval restrictions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Organisations running BMC IT Service Management Suite versions 25.3.01, 25.4.01 or 26.1.01 with SmartIT change approval enabled are affected. Attackers need a valid user account on the system. Teams not running these versions, or not using the SmartIT change approval feature, can skip it.
No product ranges from the sources yet.
25.3.01, 25.4.01 and 26.1.01No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
This page as .md · .json · in your agent: get_signal("CVE-2026-113696")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.