CVE-2026-72595: BadChoice Handesk Auth Bypass Vulnerability

CVE-2026-72595 Overview

CVE-2026-72595 is a broken access control vulnerability in BadChoice Handesk, an open-source helpdesk and ticketing application. The flaw exists in the TicketsController@update endpoint, which fails to invoke an authorize() method and performs no team-scoped ownership validation. Any authenticated agent account can modify ticket records belonging to other teams within the same Handesk instance. Attackers can escalate ticket priority, alter assignments, corrupt content, or otherwise tamper with tickets they should not access. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Any authenticated agent can update tickets belonging to other teams, enabling data tampering, priority manipulation, and workflow corruption across tenant boundaries.

Affected Products

BadChoice Handesk as of 2026-07-10
Handesk TicketsController@update endpoint
Multi-team Handesk deployments with more than one agent account

Discovery Timeline

2026-08-11 - CVE-2026-72595 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72595

Vulnerability Analysis

Handesk implements team-scoped ticket ownership so that agents only handle tickets assigned to their own team. The TicketsController@update action bypasses this model. The controller method processes incoming update requests without calling Laravel's authorize() gate and without querying whether the target ticket belongs to the requester's team. Any authenticated agent can therefore submit a PUT or PATCH request referencing an arbitrary ticket ID and mutate its fields.

Because the endpoint accepts standard ticket update payloads, attackers can change status, priority, assignee, body content, or other ticket attributes. The impact scales with the number of teams and tickets in the deployment. In shared Handesk instances used by multiple internal groups or customers, this breaks tenant isolation.

Root Cause

The root cause is a missing authorization check in the update handler. The controller relies on authentication alone to gate access, treating any authenticated agent as trusted for all tickets. Neither a policy-based authorize('update', $ticket) call nor a team ownership comparison such as $ticket->team_id === auth()->user()->team_id is performed before persisting changes.

Attack Vector

Exploitation requires only a valid low-privileged agent account and network access to the Handesk web interface. An attacker enumerates or guesses ticket identifiers, then issues an authenticated update request against TicketsController@update with a ticket ID owned by a different team. The server accepts and applies the modification. No user interaction from the victim team is required.

The vulnerability is exploitable from any network path that reaches the Handesk application, including internet-exposed deployments. See the Handesk GitHub repository for the affected controller source.

Detection Methods for CVE-2026-72595

Indicators of Compromise

Ticket update events in application logs where the acting agent's team_id does not match the ticket's team_id.
Unexpected status, priority, or assignee changes on tickets recorded outside normal working patterns for the owning team.
HTTP PUT or PATCH requests to /tickets/{id} from agent sessions that have no prior read activity on the same ticket.

Detection Strategies

Review Handesk web server access logs for update requests targeting ticket IDs that fall outside the requesting user's team scope.
Compare ticket audit trails or database change history against team membership records to identify cross-team modifications.
Instrument the TicketsController@update method with logging that records the acting user, target ticket ID, and both team IDs for every request.

Monitoring Recommendations

Forward Handesk application and web server logs to a centralized log platform and alert on cross-team ticket update patterns.
Track baseline ticket edit volumes per agent and alert on statistical anomalies such as sudden bursts of updates across many tickets.
Monitor agent account provisioning; any new low-privileged agent that immediately updates high-value tickets warrants investigation.

How to Mitigate CVE-2026-72595

Immediate Actions Required

Restrict access to the Handesk instance to trusted networks or place it behind a VPN until a patched version is deployed.
Audit all agent accounts and disable any that are unused, shared, or unnecessary.
Review recent ticket modification history for unauthorized cross-team changes and restore affected tickets from backup if needed.

Patch Information

No official patch is referenced in the NVD entry at publication. Monitor the BadChoice Handesk GitHub repository for commits that add an authorize() call and team-scoped ownership check to TicketsController@update. Apply upstream fixes as soon as they are released.

Workarounds

Patch the local Handesk deployment by adding $this->authorize('update', $ticket) inside TicketsController@update and a policy that enforces team_id equality.
Introduce a middleware or route-level guard that rejects update requests when the target ticket's team does not match the authenticated user's team.
Temporarily reduce the number of agent accounts and segregate sensitive teams into separate Handesk instances until the endpoint is fixed.

bash

# Configuration example: enforce team-scoped ticket authorization in Handesk
# 1. Add authorization to TicketsController@update (app/Http/Controllers/TicketsController.php)
#    public function update(Request $request, Ticket $ticket) {
#        $this->authorize('update', $ticket);
#        // existing update logic
#    }
#
# 2. Define TicketPolicy@update (app/Policies/TicketPolicy.php)
#    public function update(User $user, Ticket $ticket) {
#        return $user->team_id === $ticket->team_id;
#    }
#
# 3. Register the policy in AuthServiceProvider and clear caches
php artisan config:clear
php artisan route:clear
php artisan cache:clear