CVE-2026-72563 exposes a cross-tenant data access vulnerability in Handesk's Laravel application where authenticated agents can modify leads belonging to other teams. The root cause is a compound failure: the Lead model has an empty guarded array (making all fields mass-assignable), and the relevant controller endpoints lack authorization checks. Neither configuration is inherently malicious in isolation—an empty guarded array is a common Laravel pattern during rapid iteration, and developers often assume authorization is handled elsewhere. Together, they create a complete bypass: any authenticated user can write to any field of any lead in the system.
The blast radius is wider than it first appears. In a multitenant SaaS context, 'authenticated' is a weak gate—it proves a user has a valid account, not that they belong to the tenant whose data they're accessing. This means the exposure isn't abstract; it's cross-tenant by design. A developer who added guarded=[] during early development likely believed they were saving maintenance time on fillable arrays, not wiring every lead record to an unprotected endpoint.
For defenders, the priority is auditing your model-controller pairs. Check every Eloquent model with guarded=[] or guarded=[*] and trace every controller method that handles those models. Each controller endpoint touching a wide-open model needs an explicit authorization gate—either through Laravel policies, middleware, or manual checks. The absence of a gate is the vulnerability; the open model is the enabler.
The systemic problem is that this exact configuration—empty guarded array plus missing policy gate—has appeared in Laravel access control CVEs for nearly a decade with no structural remedy. Rails faced a similar CVE lineage with mass assignment and responded by moving enforcement out of the model layer entirely via strong_parameters. Laravel hasn't made that architectural shift, and the pattern keeps reproducing because the tooling communicates no risk at the point of configuration. Check your own codebase for this compound exposure before a researcher finds it.