CyberRota Analysis
AI-GeneratedA broken access control vulnerability in BadChoice Handesk allows any authenticated agent to update ticket records belonging to other teams through the TicketsController@update endpoint, which lacks proper authorization checks. This flaw enables attackers to modify, escalate, or corrupt tickets, posing a significant risk to data integrity and operational security. Organizations using BadChoice Handesk should prioritize immediate remediation to prevent potential exploitation by malicious insiders or compromised accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams.