Broken Access Control in BadChoice Handesk

CVE-2026-72595

What is CVE-2026-72595?

A critical issue in BadChoice Handesk has been identified, allowing authenticated agents to access and modify ticket records belonging to different teams through the TicketsController@update endpoint. This vulnerability arises from the absence of an authorization method and a failure to enforce team-scoped ownership checks, enabling potential attackers with agent accounts to alter, escalate, or corrupt tickets assigned to other teams. Organizations using BadChoice Handesk should take immediate steps to secure their systems and prevent unauthorized access.

References