Read the docs

BadChoice

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

BadChoice records in CISA KEV

No BadChoice vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-50852 CVE-2026-72595 · GHSA-fwxx-9hp7-v2fg

BadChoice Handesk - Broken Access Control

Priority LOW 37

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-08-11 No fix listed CWE-284
TI-2026-50822 CVE-2026-72563 · GHSA-92hh-q39m-hc93

BadChoice Handesk - Broken Access Control

Priority LOW 37

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-08-11 No fix listed CWE-284
Open these records in search →