This vulnerability in BadChoice Handesk arises from improper access control (CWE-284) where the LeadsController@update endpoint lacks authorization checks, permitting any authenticated agent to update lead records from other teams. Additionally, the Lead model's guarded attribute is empty, making all columns mass-assignable, which facilitates unauthorized data modification. The CVSS 3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, required privileges of an authenticated user, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

An attacker with any authenticated agent account can overwrite lead records belonging to other teams, leading to unauthorized data modification and corruption of lead data across team boundaries. This compromises the confidentiality and integrity of lead information but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict agent privileges to trusted users only and monitor for suspicious activity related to lead record updates. Implement additional access control checks at the application level if possible.