This vulnerability in BadChoice Handesk arises from improper access control (CWE-284) in the TicketsController@update endpoint. The endpoint does not invoke any authorization method nor verify that the ticket belongs to the agent's team. Consequently, any authenticated agent can update tickets across teams, potentially modifying or escalating tickets they should not have access to. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges of an authenticated agent, no user interaction, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

An attacker with any authenticated agent account can modify ticket records belonging to other teams, leading to unauthorized data modification, escalation of tickets, or corruption of ticket data. This compromises the confidentiality and integrity of ticket information across teams within the Handesk system. Availability is not affected. The vulnerability could disrupt normal ticket handling workflows and trust in the system's access controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict agent privileges to minimize exposure and monitor for unusual ticket update activities. Implement additional access control checks at the application level if possible.