Description
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BMC BMC IT Service Management Suite
Default version status: unknown
25.3.01affected25.3.01 hotfix 10unaffected25.4.01affected25.4.01 hotfix 22unaffected26.1.01affected26.1.01 hotfix 12unaffected
References
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/ ↗