GCVE - cpe:2.3:a:badchoice:handesk:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:badchoice:handesk:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-72563`	vulnerable	2026-09-16 04:33:09.499895	BadChoice Handesk - Broken Access Control HIGH (8.1) A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint. The endpoint performs no authorization check, and the Lead model has guarded set to an empty array making all columns mass-assignable. An attacker with any agent account can corrupt lead data across team boundaries. Published: 2026-08-11T11:13:15.327Z Updated: 2026-08-11T12:17:06.149Z Open on db.gcve.eu Reference links https://github.com/BadChoice/handesk	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-72595`	vulnerable	2026-09-16 04:33:08.616952	BadChoice Handesk - Broken Access Control HIGH (8.1) A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams. Published: 2026-08-11T11:13:28.057Z Updated: 2026-08-11T12:16:15.356Z Open on db.gcve.eu Reference links https://github.com/BadChoice/handesk	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.