CVE-2026-72595
Received Received - Intake

Broken Access Control in BadChoice Handesk

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72595
EUVD
EUVD-2026-56034

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
revo_systems handesk *
badchoice handesk *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a broken access control vulnerability in BadChoice Handesk where any authenticated agent can update ticket records belonging to other teams without proper authorization checks. The TicketsController@update endpoint lacks an authorize() method and team-scoped ownership verification, allowing attackers with agent accounts to modify or corrupt tickets assigned to different teams.

Detection Guidance

Check for unauthorized ticket modifications in BadChoice Handesk by reviewing logs for the TicketsController@update endpoint. Look for requests where authenticated agents update tickets not assigned to their team. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to modify, escalate, or corrupt tickets assigned to other teams, potentially leading to data integrity issues, unauthorized changes, or service disruptions. This could affect business operations, customer trust, and internal workflows.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive ticket data, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Immediately update BadChoice Handesk to a patched version. Implement team-scoped ownership checks in the TicketsController@update endpoint. Restrict agent permissions to only modify tickets within their assigned teams.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72595. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart