Executive brief
BadChoice Handesk is a Laravel-based help desk and lead management application used by support teams. A flaw allows any authenticated agent to overwrite lead records belonging to other teams, enabling data corruption and loss of critical customer information across organizational boundaries.
Technical details
This is a broken access control vulnerability in the LeadsController@update endpoint. The endpoint fails to perform authorization checks before allowing lead record modifications, and the Lead model has an empty guarded array, making all database columns mass-assignable. An attacker with any valid agent account can exploit this by sending crafted requests to modify lead data belonging to teams they do not belong to. The vulnerability requires authentication but allows cross-team data manipulation, potentially resulting in lead record corruption and data integrity loss.
Affected products
- BadChoice Handesk as of 2026-07-10
Timeline
- 2026-08-11: disclosed
- other: Vulnerability present as of 2026-07-10