{"id":"CVE-2026-113696","kind":"vulnerability","aliases":["CVE-2026-113696"],"related":[],"title":"BMC ITSM SmartIT: authenticated users can bypass change approval restrictions","description":"Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.","summary":"BMC IT Service Management Suite's SmartIT change approval feature does not check authorization properly. A logged-in user can change approval state and get around intended approval restrictions.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","change-management","itsm","other","smartit"],"not_affected_if":["no-smartit-change-approval","no-user-accounts-exposed","other-versions"],"how_to_check":"- Confirm whether the BMC IT Service Management Suite (SmartIT) is deployed, and note its version against `25.3.01`, `25.4.01` and `26.1.01`","fix":null,"status":"open","published_at":"2026-10-29T14:17:45+00:00","first_seen_at":"2026-10-29T14:25:22+00:00","triaged_at":"2026-10-29T14:26:09+00:00","updated_at":"2026-10-29T14:26:09+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T14:26:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BMC ITSM SmartIT: authenticated users can bypass change approval restrictions","impact":"medium","summary":"BMC IT Service Management Suite's SmartIT change approval feature does not check authorization properly. A logged-in user can change approval state and get around intended approval restrictions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["bmc","itsm","smartit","change-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user bypasses change approvals and alters approval state","analyst_note":"Find the BMC advisory and fixed versions for SmartIT change approval; the NVD entry gives no fix or check steps.","how_to_check":"- Confirm whether the BMC IT Service Management Suite (SmartIT) is deployed, and note its version against `25.3.01`, `25.4.01` and `26.1.01`\n- unknown for other checks: the sources do not say which settings or files to inspect","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-smartit-change-approval","no-user-accounts-exposed"],"who_is_affected":"Organisations running BMC IT Service Management Suite versions 25.3.01, 25.4.01 or 26.1.01 with SmartIT change approval enabled are affected. Attackers need a valid user account on the system. Teams not running these versions, or not using the SmartIT change approval feature, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4117,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113696':13A,16A '-2026':12A,15A '25.3.01':69C '25.4.01':70C '26.1.01':72C 'allow':73C 'approv':9A,32B,46B,52B,60C,81C,86C 'around':50B 'authent':4A,74C 'author':37B,55C 'bmc':1A,17B,24B,63C 'bypass':7A,84C 'chang':8A,19B,31B,45B,59C,79C 'change-manag':18B 'check':36B 'cve':11A,14A 'featur':33B,61C 'get':49B 'improp':54C 'intend':51B,85C 'itsm':2A,21B 'log':41B 'logged-in':40B 'make':77C 'manag':20B,27B,66C 'proper':38B 'restrict':10A,53B,87C 'servic':26B,65C 'smartit':3A,23B,30B,58C 'state':47B,82C 'suit':28B,67C 'unauthor':78C 'user':5A,43B,75C 'version':68C","nicknames":[],"mitigations":[],"who_affected":"Organisations running BMC IT Service Management Suite versions 25.3.01, 25.4.01 or 26.1.01 with SmartIT change approval enabled are affected. Attackers need a valid user account on the system. Teams not running these versions, or not using the SmartIT change approval feature, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"47237f96-ddbe-4467-a5ee-293a770beacd","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113696","severity":null,"published_at":"2026-10-29T14:17:45+00:00","modified_at":"2026-10-29T14:17:45+00:00","first_seen_at":"2026-10-29T14:25:22+00:00","fetched_at":"2026-10-29T14:25:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}