What is the CVSS score of EUVD-2026-56034?

EUVD-2026-56034 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Handesk are affected by EUVD-2026-56034?

BadChoice Handesk versions through 2026-07-10 contain a broken access control vulnerability that allows any authenticated agent to modify or delete tickets outside their assigned teams.

How to fix or mitigate EUVD-2026-56034?

Within 24 hours, begin immediate audit of ticket modification logs to identify any cross-team changes made by agents not assigned to those teams, and revoke credentials of any agents suspected of unauthorized access. Within 7 days, implement firewall or API gateway rules to restrict direct HTTP requests to the TicketsController@update endpoint, optionally enforce single-team scope on agent accounts as a temporary measure, and document your multi-team deployment topology for risk assessment. Within 30 days, monitor BadChoice Handesk security advisories for patch release, conduct a complete audit of ticket record modifications during the vulnerability window, and plan a staged upgrade path once a vendor patch is available.

Handesk EUVD-2026-56034

| CVE-2026-72595 HIGH

Improper Access Control (CWE-284)

2026-08-11 TuranSec

GHSA-fwxx-9hp7-v2fg

Authentication Bypass Handesk

8.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable HTTP endpoint requires only a low-privilege agent account; no availability impact or scope change applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:15 vuln.today

CVE Published

Aug 11, 2026 - 11:13 cve.org

HIGH 8.1

DescriptionCVE.org

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams.

AnalysisAI

Broken access control in BadChoice Handesk (all versions through 2026-07-10) permits any authenticated agent to modify, escalate, or corrupt ticket records belonging to teams they have no membership in, by directly targeting the TicketsController@update endpoint. The endpoint performs neither an authorize() policy check nor a team-scoped ownership validation, meaning a low-privilege agent account is the only barrier to cross-team data tampering. No public exploit has been identified at time of analysis, but exploitation requires only a valid agent credential and a single crafted HTTP request, making this a low-friction privilege abuse risk in any multi-team deployment.

Technical ContextAI

Handesk is a Laravel-based open-source helpdesk and ticketing system maintained by BadChoice on GitHub (https://github.com/BadChoice/handesk). Laravel's authorization framework relies on Policy classes and the authorize() method to enforce resource-level access control; the absence of either in TicketsController@update means the framework's own gate-checking mechanism is never invoked for this operation. CWE-284 (Improper Access Control) precisely describes this failure pattern: the application authenticates the principal but fails to verify whether that principal holds sufficient permissions over the specific resource being acted upon - a classic confused deputy scenario within the application layer. The CPE string cpe:2.3:a:badchoice:handesk:*:*:*:*:*:*:*:* uses a wildcard version component, confirming no upstream-released fixed version has been registered with NVD at time of analysis.

RemediationAI

No vendor-released patch has been identified at time of analysis; the GitHub repository at https://github.com/BadChoice/handesk should be monitored for upstream commits that introduce an authorize() policy gate or team-scoped ownership check within the TicketsController@update method. Organizations running Handesk should pull and review the repository's commit history after 2026-07-10 for any remediation commits before upgrading. As an immediate compensating control, restrict agent account provisioning to fully trusted personnel only and enforce network-level access controls - such as a VPN requirement or IP allowlist - on the Handesk web interface to reduce the pool of accounts that could be leveraged; this reduces exposure but does not eliminate the flaw. If the application framework permits route-level disablement, temporarily removing the ticket update route in the web router can suppress the vulnerable endpoint at the cost of disabling ticket update functionality for all agents. Audit existing agent accounts and review application logs for anomalous cross-team ticket modifications (e.g., update events on tickets where the acting agent's team ID does not match the ticket's assigned team ID) to detect potential prior exploitation.