CVE-2026-19539

This CVE exposes a flaw that runs deeper than a single missing authorization check — it reveals a codebase where tenant isolation was never established as a mandatory architectural pattern. The vulnerability affects read, save, and delete operations on tickets, and in all three cases the root cause is the same: queries retrieve records without constraining to the authenticated user's company. That's not three independent oversights; it's evidence of a systematic gap in how the application handles multi-tenant data boundaries. The delete operation compounds this with a second failure: it uses a generic Request type-hint instead of the TicketDeleteRequest class that presumably contains authorization logic. This isn't just a developer shortcut — it's a symptom of Laravel's form request authorization being opt-in by design. The developer had to either write the authorization check and then deliberately bypass it, or more likely, never write the tenant-scoping logic at all because the scaffold didn't generate it. Either way, the pattern points to a shared generative origin — a CRUD generator or tutorial that never produced tenant-scoped queries. In a CRM context, the impact extends far beyond the ticket table. Tickets reference contacts, link to deals, attach to companies, and surface in communication threads. An attacker who can read another company's tickets can enumerate which contacts that company works with, which deals are active, and what support issues they're experiencing. This isn't a data breach — it's competitive intelligence extraction. The pivot potential is significant: if this unscoped query pattern exists in tickets, it likely exists in other resources (contacts, companies, deals) that went through the same retrofit-to-multi-tenant process. Audit your codebase for this pattern: search every model query for missing where clauses on company_id or tenant_id. Check your form request classes — if they exist but aren't type-hinted in controller methods, that's a fossil indicating decayed authorization. And critically, examine your CRUD scaffolding tools: if the generator that created these endpoints has the same flaw, every future resource will inherit the vulnerability until the tool itself is fixed.

Reviewed through automated stages and approved by a human before publication.