What is the CVSS score of CVE-2026-72563?

CVE-2026-72563 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of BadChoice Handesk are affected by CVE-2026-72563?

BadChoice Handesk deployments across all versions through 2026-07-10 contain an authorization flaw allowing any authenticated agent to modify lead records owned by other teams, creating cross-team…

How to fix or mitigate CVE-2026-72563?

Within 24 hours: inventory all BadChoice Handesk deployments and versions currently in production, identify multi-team instances at risk, and audit agent access logs for unauthorized cross-team lead record modifications. Within 7 days: implement compensating controls including restricting agent permissions to assigned team boundaries via application-layer access controls, enable detailed audit logging on the LeadsController@update endpoint, and contact BadChoice vendor for patch timeline and technical mitigation options. Within 30 days: monitor vendor security advisories for patch release, plan and execute upgrade to patched version upon availability, and conduct a cross-application review to identify other authorization-bypass patterns sharing the same $guarded property weakness.

BadChoice Handesk CVE-2026-72563

EUVD-2026-56033 HIGH

Improper Access Control (CWE-284)

2026-08-11 TuranSec

GHSA-92hh-q39m-hc93

Authentication Bypass Handesk

8.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable web endpoint requires only a valid agent session (PR:L); no complexity; arbitrary cross-team lead overwrite yields High integrity and confidentiality impact; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:14 vuln.today

CVE Published

Aug 11, 2026 - 11:13 cve.org

HIGH 8.1

DescriptionCVE.org

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint. The endpoint performs no authorization check, and the Lead model has guarded set to an empty array making all columns mass-assignable. An attacker with any agent account can corrupt lead data across team boundaries.

AnalysisAI

Cross-team lead record overwrite in BadChoice Handesk (all versions through 2026-07-10) is exploitable by any authenticated agent via the LeadsController@update endpoint, which performs no team-ownership authorization check. The Lead model's $guarded property is set to an empty array, disabling Laravel mass-assignment protection and allowing the attacker to set any column value on any lead record regardless of team boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:L/AC:L vector makes this trivially exploitable by any insider or compromised agent account in a multi-team deployment.

Technical ContextAI

Handesk is an open-source PHP/Laravel helpdesk and lead-management application maintained by BadChoice (CPE: cpe:2.3:a:badchoice:handesk:*:*:*:*:*:*:*:*; source: https://github.com/BadChoice/handesk). The root cause is CWE-284 (Improper Access Control) manifesting at two layers simultaneously: the LeadsController@update route handler applies no policy or gate check to confirm the requesting agent belongs to the team that owns the targeted lead ID, and the Laravel Eloquent Lead model has its $guarded attribute set to [] rather than a restricted allowlist, bypassing Laravel's built-in mass-assignment protection. Together, these defects mean that a crafted HTTP request specifying an arbitrary lead ID will be accepted and applied without any ownership verification, and all model columns - including team-association fields - are writable in a single request.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified at time of analysis - patch status should be tracked against the upstream repository at https://github.com/BadChoice/handesk, monitoring for commits that add team-ownership authorization to LeadsController@update and restrict the Lead model's $guarded or $fillable attributes. As an immediate compensating control, administrators should restrict the Handesk interface to trusted internal networks or VPN, reducing the attack surface to internal actors only (trade-off: does not prevent insider or compromised-account exploitation). Agent account provisioning should be audited and limited to the minimum necessary users, since any agent credential is sufficient for exploitation - reducing the agent population limits blast radius (trade-off: operational inconvenience). For organizations with PHP/Laravel expertise, a custom middleware or policy gate validating team ownership before processing update requests can be applied to the running instance (trade-off: regression risk without vendor support and must be reapplied after upgrades). Availability of an official patch should be verified before assuming the above interim controls are sufficient.