GHSA-w7v2-jfcq-2jh7Medium
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite...
🔗 CVE IDs covered (1)
📋 Description
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-113694
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113694/advisory.md
- https://github.com/advisories/GHSA-w7v2-jfcq-2jh7