diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4184cb88..578d5348 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Fixed
 
 - Fix massive action modal not showing when a group has more than 10 associated groups
+- Strengthen input validation and access checks on ticket escalation actions
 
 ## [2.10.4] - 2026-06-24
 
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..ef1bed5a
--- /dev/null
+++ b/Makefile
@@ -0,0 +1 @@
+include ../../PluginsMakefile.mk
diff --git a/ajax/assign_me.php b/ajax/assign_me.php
index 40fe44e1..e358d467 100644
--- a/ajax/assign_me.php
+++ b/ajax/assign_me.php
@@ -36,4 +36,9 @@
     throw new BadRequestHttpException();
 }
 
-PluginEscaladeTicket::assign_me((int) $_REQUEST['tickets_id']);
+$tickets_id = (int) $_REQUEST['tickets_id'];
+
+$ticket = new Ticket();
+$ticket->check($tickets_id, UPDATE);
+
+PluginEscaladeTicket::assign_me($tickets_id);
diff --git a/ajax/cloneandlink_ticket.php b/ajax/cloneandlink_ticket.php
index 112aa511..0b60a113 100644
--- a/ajax/cloneandlink_ticket.php
+++ b/ajax/cloneandlink_ticket.php
@@ -46,11 +46,13 @@
     throw new BadRequestHttpException();
 }
 
+$tickets_id = (int) $_REQUEST['tickets_id'];
+
 $ticket = new Ticket();
 
-if ($ticket->getFromDB($_REQUEST['tickets_id'])) {
+if ($ticket->getFromDB($tickets_id)) {
     if (
-        !$ticket->can($_REQUEST['tickets_id'], READ)
+        !$ticket->can($tickets_id, READ)
         || !Ticket::canCreate()
     ) {
         throw new AccessDeniedHttpException(
@@ -58,5 +60,5 @@
         );
     }
 
-    PluginEscaladeTicket::cloneAndLink($_REQUEST['tickets_id']);
+    PluginEscaladeTicket::cloneAndLink($tickets_id);
 }
diff --git a/ajax/history.php b/ajax/history.php
index bcfafc88..9948f122 100644
--- a/ajax/history.php
+++ b/ajax/history.php
@@ -34,5 +34,10 @@
 Session::checkLoginUser();
 
 if (isset($_REQUEST['tickets_id'])) {
-    PluginEscaladeHistory::getHistory($_REQUEST['tickets_id']);
+    $tickets_id = (int) $_REQUEST['tickets_id'];
+
+    $ticket = new Ticket();
+    $ticket->check($tickets_id, READ);
+
+    PluginEscaladeHistory::getHistory($tickets_id);
 }
diff --git a/front/climb_group.php b/front/climb_group.php
index e7b37663..c95c3f49 100644
--- a/front/climb_group.php
+++ b/front/climb_group.php
@@ -27,7 +27,7 @@
  * @link      https://github.com/pluginsGLPI/escalade
  * -------------------------------------------------------------------------
  */
-use Glpi\Exception\Http\AccessDeniedHttpException;
+
 use Glpi\Exception\Http\BadRequestHttpException;
 
 Session::checkLoginUser();
@@ -44,12 +44,9 @@
     throw new BadRequestHttpException();
 }
 
-$ticket = new Ticket();
-$ticket->getFromDB((int) $_REQUEST['tickets_id']);
-
-if (!$ticket->canAssign()) {
-    throw new AccessDeniedHttpException();
-}
+$tickets_id = (int) $_REQUEST['tickets_id'];
 
+$ticket = new Ticket();
+$ticket->check($tickets_id, UPDATE);
 
-PluginEscaladeTicket::climb_group((int) $_REQUEST['tickets_id'], (int) $_REQUEST['groups_id']);
+PluginEscaladeTicket::climb_group($tickets_id, (int) $_REQUEST['groups_id']);
diff --git a/front/group_group.form.php b/front/group_group.form.php
index 6c55740c..37899cf6 100644
--- a/front/group_group.form.php
+++ b/front/group_group.form.php
@@ -28,20 +28,40 @@
  * -------------------------------------------------------------------------
  */
 
+use Glpi\Exception\Http\AccessDeniedHttpException;
+
 Session::checkLoginUser();
 
 Html::header("escalade", $_SERVER["PHP_SELF"], "plugins", "escalade", "group_group");
 
 if (Session::haveRight('group', UPDATE)) {
     if (isset($_POST['addgroup'])) {
+        $group_source = new Group();
+        $group_destination = new Group();
+        if (
+            !$group_source->getFromDB((int) $_POST['groups_id_source'])
+            || !Session::haveAccessToEntity($group_source->getEntityID())
+            || !$group_destination->getFromDB((int) $_POST['groups_id_destination'])
+            || !Session::haveAccessToEntity($group_destination->getEntityID())
+        ) {
+            throw new AccessDeniedHttpException();
+        }
+
         $PluginEscaladeGroup_Group = new PluginEscaladeGroup_Group();
         $PluginEscaladeGroup_Group->add($_POST);
     }
 
     if (isset($_POST['deleteitem'])) {
         $PluginEscaladeGroup_Group = new PluginEscaladeGroup_Group();
+        $group = new Group();
         foreach ($_POST['delgroup'] as $id) {
-            $PluginEscaladeGroup_Group->delete(['id' => $id]);
+            if (
+                $PluginEscaladeGroup_Group->getFromDB((int) $id)
+                && $group->getFromDB((int) $PluginEscaladeGroup_Group->fields['groups_id_source'])
+                && Session::haveAccessToEntity($group->getEntityID())
+            ) {
+                $PluginEscaladeGroup_Group->delete(['id' => $id]);
+            }
         }
     }
 }
diff --git a/front/popup_histories.php b/front/popup_histories.php
index 723faf00..b96fc252 100644
--- a/front/popup_histories.php
+++ b/front/popup_histories.php
@@ -41,8 +41,13 @@
     throw new AccessDeniedHttpException();
 }
 
+$tickets_id = (int) $_REQUEST['tickets_id'];
+
+$ticket = new Ticket();
+$ticket->check($tickets_id, READ);
+
 echo "<div id='page'>";
-PluginEscaladeHistory::getHistory((int) $_REQUEST['tickets_id'], true);
+PluginEscaladeHistory::getHistory($tickets_id, true);
 echo "</div>";
 
 Html::popFooter();
diff --git a/front/ticket.form.php b/front/ticket.form.php
index b6aa396b..82a1ddf1 100644
--- a/front/ticket.form.php
+++ b/front/ticket.form.php
@@ -28,8 +28,6 @@
  * -------------------------------------------------------------------------
  */
 
-use Glpi\Exception\Http\AccessDeniedHttpException;
-
 Session::checkLoginUser();
 
 /** @var array $CFG_GLPI */
@@ -40,14 +38,7 @@
     $tickets_id = (int) $_POST['tickets_id'];
 
     $ticket = new Ticket();
-    if (!$ticket->getFromDB($tickets_id)) {
-        throw new AccessDeniedHttpException();
-    }
-
-    // Same right check as in PluginEscaladeTicket::addToTimeline()
-    if (!$ticket->canAssign()) {
-        throw new AccessDeniedHttpException();
-    }
+    $ticket->check($tickets_id, UPDATE);
 
     PluginEscaladeTicket::timelineClimbAction($group_id, $tickets_id, $_POST);
 
diff --git a/inc/history.class.php b/inc/history.class.php
index 5201ff72..f2e7784d 100644
--- a/inc/history.class.php
+++ b/inc/history.class.php
@@ -246,7 +246,7 @@ public static function showGroupLink($group, $full_history = false)
     {
 
         if (!$group->can($group->fields['id'], READ)) {
-            return $group->getNameID(true);
+            return '';
         }
 
         $link_item = $group->getFormURL();
diff --git a/inc/ticket.class.php b/inc/ticket.class.php
index 07670c8e..0b9beb07 100644
--- a/inc/ticket.class.php
+++ b/inc/ticket.class.php
@@ -1005,6 +1005,9 @@ public static function cloneAndLink($tickets_id)
         /** @var DBmysql $DB */
         global $DB;
 
+        // Enforce integer type before interpolation in the raw SQL below (SQL injection guard)
+        $tickets_id = (int) $tickets_id;
+
         //get old ticket
         $ticket = new Ticket();
         if (!$ticket->getFromDB($tickets_id)) {