---
id: CVE-2026-113696
title: Improper Authorization in BMC ITSM SmartIT Change Approvals
summary: >-
  Improper authorization in the SmartIT change approval feature of BMC IT
  Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows
  authenticated users to make unauthorized changes to approval state and bypass
  intended approva…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-285
vendor: BMC
product: BMC IT Service Management Suite
affected:
  - it_service_management_suite 25.3.01
  - it_service_management_suite 25.4.01
  - it_service_management_suite 26.1.01
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T13:49:45.547508Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:49:59.814Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113696'
references:
  - url: >-
      https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md
    label: NCSC advisory CVE-2026-113696
  - url: >-
      https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
    label: BMC Helix Service Management 25.3.01 hotfix 10 corrected issues
  - url: >-
      https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
    label: BMC Helix Service Management 25.4.01 hotfix 22 corrected issues
  - url: >-
      https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
    label: BMC Helix Service Management 26.1.01 hotfix 12 corrected issues
tags:
  - cve.org
epss: 0.00402
epssPercentile: 0.34583
ingestedAt: '2026-11-01T18:59:04.495Z'
---

## Overview

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

## Affected

- `it_service_management_suite 25.3.01`
- `it_service_management_suite 25.4.01`
- `it_service_management_suite 26.1.01`

## Remediation

Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.