A broken access control flaw in BadChoice Handesk lets any authenticated user modify lead records that belong to other teams. The LeadsController@update method lacks an authorization check, and the Lead model permits mass assignment of all attributes because its guarded array is empty. As a result, an attacker can overwrite sensitive fields in any lead record, degrading the accuracy of lead data and potentially misleading downstream processes.

The vulnerability affects the BadChoice Handesk application, specifically the LeadsController component. Current versions running as of 2026-07-10 are impacted; no further version constraints are disclosed in the dataset.

The CVSS score of 8.1 reflects a high-scale impact and indicates that exploitation is likely to succeed if an attacker can log in as any agent. There is no EPSS score available, but the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. An attacker with a valid agent account can directly navigate to the update endpoint (e.g., /leads/{id}) and supply arbitrary data to overwrite another team's lead. Since the application performs no additional checks, the attack vector is straightforward and does not require escalating privileges beyond normal authentication.