CVE-2026-113694 (GCVE-0-2026-113694)
Vulnerability from cvelistv5
Published
2026-10-29 13:12
Modified
2026-10-29 13:51
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
Summary
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:50:57.458750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:51:08.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT user attachment feature"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.\u003c/p\u003e"
            }
          ],
          "value": "Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can perform the attack remotely without additional user interaction."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:12:52.855Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113694",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113694/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Improper Authorization in BMC ITSM SmartIT Attachments",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113694",
    "datePublished": "2026-10-29T13:12:52.855Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T13:51:08.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"47237f96-ddbe-4467-a5ee-293a770beacd\", \"shortName\": \"NCSC\", \"dateUpdated\": \"2026-10-29T13:12:52.855Z\"}, \"title\": \"Improper Authorization in BMC ITSM SmartIT Attachments\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285 Improper Authorization\", \"type\": \"CWE\"}]}], \"affected\": [{\"vendor\": \"BMC\", \"product\": \"BMC IT Service Management Suite\", \"modules\": [\"SmartIT user attachment feature\"], \"versions\": [{\"status\": \"affected\", \"version\": \"25.3.01\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"25.3.01 hotfix 10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"25.4.01\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"25.4.01 hotfix 22\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"26.1.01\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"26.1.01 hotfix 12\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eImproper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.\u003c/p\u003e\"}]}], \"references\": [{\"url\": \"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113694/advisory.md\", \"name\": \"NCSC advisory CVE-2026-113694\"}, {\"url\": \"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/\", \"name\": \"BMC Helix Service Management 25.3.01 hotfix 10 corrected issues\"}, {\"url\": \"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/\", \"name\": \"BMC Helix Service Management 25.4.01 hotfix 22 corrected issues\"}, {\"url\": \"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/\", \"name\": \"BMC Helix Service Management 26.1.01 hotfix 12 corrected issues\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"An authenticated user can perform the attack remotely without additional user interaction.\"}], \"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"version\": \"4.0\", \"baseSeverity\": \"MEDIUM\", \"baseScore\": 5.3, \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\"}}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Justin HOCQUEL, NCSC\", \"type\": \"finder\"}], \"source\": {\"discovery\": \"INTERNAL\"}, \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-113694\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-29T13:50:57.458750Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-29T13:51:04.153Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-113694\", \"assignerOrgId\": \"47237f96-ddbe-4467-a5ee-293a770beacd\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"NCSC\", \"dateReserved\": \"2026-10-20T15:07:33.735Z\", \"datePublished\": \"2026-10-29T13:12:52.855Z\", \"dateUpdated\": \"2026-10-29T13:51:08.903Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.