CVE-2026-72595

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10

Description Broken access control allows any authenticated agent to update ticket records belonging to other teams. This occurs because the 'TicketsController@update' endpoint does not call an authorize() method and fails to perform a team-scoped ownership check. An attacker with agent privileges can modify, escalate, or corrupt tickets assigned to different teams.

Recommendations Update BadChoice Handesk to a version released after 2026-07-10. As a temporary mitigation, restrict access to the 'TicketsController@update' endpoint to only authorized administrative roles.