CVE-2026-72595

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

CVE-2026-72595 BadChoice Handesk - Broken Access Control

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

CVE-2026-72595

CVE-2026-72595 : In BadChoice Handesk, the vulnerability affects the TicketsController@update endpoint where no authorization check is performed and no team-scoped ownership is enforced. This allows any authenticated agent to update ticket records belonging to other teams, enabling modification, ...

CVE-2026-72595

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

CVE-2026-72595 BadChoice Handesk - Broken Access Control

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

EUVD-2026-56034

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

CVE-2026-72595: Improper Access Control

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...

PT-2026-70139

Name of the Vulnerable Software and Affected Versions BadChoice Handesk versions prior to 2026-07-10 Description Broken access control allows any authenticated agent to update ticket records belonging to other teams. This occurs because the 'TicketsController@update' endpoint does not call an...

CVE-2025-25203 Ctrlpanel has stored XSS vulnerability in TicketsController priority field

CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting XSS vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and unsafe rendering o...

CVE-2025-25203

CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting XSS vulnerability exists in the "TicketsController" and "Moderation/TicketsController" due to insufficient input validation on the "priority" field during ticket creation and unsafe...

PT-2025-6412

Name of the Vulnerable Software and Affected Versions CtrlPanel versions prior to 1.0 Description A Cross-Site Scripting XSS issue exists due to insufficient input validation on the priority field during ticket creation and unsafe rendering of this field in the moderator panel, specifically in th...

CVE-2025-25203: Improper Neutralization of Input During Web Page Generation

CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting XSS vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and unsafe rendering o...