CVE-2026-113696
Awaiting Analysis
Awaiting Analysis - Queue
Improper Authorization in BMC IT Service Management Suite
Vulnerability report for CVE-2026-113696, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: 47237f96-ddbe-4467-a5ee-293a770beacd
Description
Description
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| BMC | BMC IT Service Management Suite | 25.3.01 |
| BMC | BMC IT Service Management Suite | 25.4.01 |
| BMC | BMC IT Service Management Suite | 26.1.01 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
