https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T06:23:18.172598+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-72595 fkie_cve-2026-72595 2026-10-01T06:23:18.198819+00:00

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams.

 https://db.gcve.eu/vuln/ghsa-fwxx-9hp7-v2fg GHSA-fwxx-9hp7-v2fg 2026-10-01T06:23:18.198900+00:00

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and performs no team-scoped ownership check. An attacker with any agent account can modify, escalate, or corrupt tickets assigned to other teams.