CVE-2026-72595

Deferred Deferred - Pending Action

Broken Access Control in BadChoice Handesk

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: TuranSec

Description

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-72595

EUVD

EUVD-2026-56034

Affected Vendors & Products

Vendor	Product	Version / Range
revo_systems	handesk	*
badchoice	handesk	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a broken access control vulnerability in BadChoice Handesk where any authenticated agent can update ticket records belonging to other teams without proper authorization checks. The TicketsController@update endpoint lacks an authorize() method and team-scoped ownership verification, allowing attackers with agent accounts to modify or corrupt tickets assigned to different teams.

Detection Guidance

Check for unauthorized ticket modifications in BadChoice Handesk by reviewing logs for the TicketsController@update endpoint. Look for requests where authenticated agents update tickets not assigned to their team. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to modify, escalate, or corrupt tickets assigned to other teams, potentially leading to data integrity issues, unauthorized changes, or service disruptions. This could affect business operations, customer trust, and internal workflows.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive ticket data, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Immediately update BadChoice Handesk to a patched version. Implement team-scoped ownership checks in the TicketsController@update endpoint. Restrict agent permissions to only modify tickets within their assigned teams.

Hi! I’m here to help you understand CVE-2026-72595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70