CVE-2026-72563: BadChoice Handesk Auth Bypass Vulnerability

CVE-2026-72563 Overview

CVE-2026-72563 is a broken access control vulnerability in BadChoice Handesk, an open-source helpdesk and lead management application. The flaw resides in the LeadsController@update endpoint, which performs no authorization checks before writing to lead records. Any authenticated agent can modify lead data owned by other teams by supplying a target lead identifier in the update request. The Lead model compounds the issue by declaring guarded = [], which makes every column mass-assignable through user input. The weakness is tracked under [CWE-284: Improper Access Control].

Critical Impact
Authenticated low-privileged agents can overwrite arbitrary lead records across team boundaries, corrupting customer relationship data and violating multi-tenant isolation.

Affected Products

BadChoice Handesk (helpdesk and lead management application)
Deployments running the vulnerable LeadsController@update route as of 2026-07-10
Instances using the Lead Eloquent model with guarded = []

Discovery Timeline

2026-08-11 - CVE-2026-72563 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72563

Vulnerability Analysis

Handesk exposes an update route that maps HTTP PUT or PATCH requests to LeadsController@update. The controller accepts a lead identifier from the request path and applies request parameters directly to the resolved Lead model. It does not verify that the authenticated agent belongs to the team that owns the target lead. As a result, tenant isolation is enforced only implicitly through the user interface, not at the controller or model layer.

Because the Lead Eloquent model sets protected $guarded = [], Laravel's mass-assignment protection is disabled for every attribute. An attacker can therefore overwrite fields such as team_id, user_id, status, contact, or free-text lead content in a single request. The combination of missing authorization and unrestricted mass assignment turns a routine update handler into a cross-tenant data tampering primitive.

Root Cause

The root cause is two-fold. First, LeadsController@update lacks an authorization gate, policy check, or scoped query that constrains updates to leads owned by the requesting agent's team. Second, the Lead model opts out of mass-assignment protection, allowing attacker-controlled request keys to reach the database as column writes. Together they violate the principle of least privilege at both the routing and persistence layers.

Attack Vector

Exploitation requires a valid agent account and network reachability to the Handesk web interface. The attacker enumerates or guesses a lead identifier owned by another team, then issues an authenticated update request supplying arbitrary attribute values. See the Handesk GitHub repository for the affected controller and model definitions. No user interaction from the victim team is required, and no additional privileges are needed beyond the standard agent role.

The vulnerability enables integrity impact against lead records and can be chained with reassignment of ownership fields to remove a lead from the legitimate team's view. Confidentiality is impacted where the response body echoes the updated record back to the attacker.

Detection Methods for CVE-2026-72563

Indicators of Compromise

Unexpected changes to updated_at timestamps on leads table rows without a corresponding legitimate workflow entry
Application audit log entries showing LeadsController@update calls where the acting agent's team_id does not match the lead's team_id
Sudden reassignment of team_id or user_id values on lead records outside of documented business processes

Detection Strategies

Instrument the LeadsController@update action to log the authenticated agent identifier, target lead identifier, and owning team on every invocation
Compare each update request's owning team against the acting agent's team and alert on mismatches
Baseline the volume of lead updates per agent and flag deviations that suggest scripted enumeration of lead identifiers

Monitoring Recommendations

Forward Handesk web server access logs and Laravel application logs to a centralized analytics platform for correlation
Enable database-level auditing on the leads table to capture row-level modifications and the associated database session
Review web application firewall telemetry for sequential PUT or PATCH requests to /leads/{id} from a single session

How to Mitigate CVE-2026-72563

Immediate Actions Required

Restrict access to the Handesk instance to trusted networks or place it behind a VPN until a fix is deployed
Revoke or rotate agent accounts that are not strictly required, reducing the population of users who can reach the vulnerable endpoint
Audit the leads table for unauthorized modifications and restore affected records from backup where possible

Patch Information

No vendor advisory or patched release is referenced in the NVD entry at the time of publication. Monitor the upstream Handesk GitHub repository for commits that introduce an authorization policy on LeadsController@update and remove the empty guarded array on the Lead model.

Workarounds

Apply a local patch that adds a Laravel policy or gate check verifying the acting agent's team owns the target lead before the update proceeds
Replace protected $guarded = [] on the Lead model with an explicit $fillable array that excludes sensitive fields such as team_id, user_id, and id
Add middleware that scopes lead lookups by the authenticated user's team, so cross-team identifiers resolve to a 404 response

bash

# Configuration example: scope lead updates to the acting agent's team
# In app/Http/Controllers/LeadsController.php
public function update(Request $request, $id)
{
    $lead = Lead::where('team_id', auth()->user()->team_id)
                ->findOrFail($id);

    $data = $request->only(['title', 'contact', 'status', 'notes']);
    $lead->update($data);

    return response()->json($lead);
}

# In app/Lead.php, replace guarded with an explicit fillable list
protected $fillable = ['title', 'contact', 'status', 'notes'];