CVE-2026-72563

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10

Description Broken access control allows authenticated agents to overwrite lead records belonging to other teams. This occurs because the 'LeadsController@update' endpoint lacks authorization checks and the Lead model has guarded set to an empty array, which enables mass-assignment (a feature that allows multiple database columns to be updated simultaneously via a single request). An attacker with agent privileges can corrupt lead data across different team boundaries.

Recommendations Update to a version released after 2026-07-10. Restrict access to the 'LeadsController@update' endpoint until a patch is applied.