IDOR in Downloadable Chat Transcripts
Sequential transcript filenames expose an authorization gap: changing the requested object retrieves another lab user's conversation and synthetic credential.
taxonomy / tag
#access-control
Horizontal Privilege Escalation Through a User-Controlled Account ID
Changing the account identifier in the request returns another lab user's profile, demonstrating missing object-level authorization and exposing the synthetic API key.
Privilege Escalation Through a Client-Controlled Role Cookie
The application trusts a client-controlled role cookie, so changing its value grants access to the administration panel and its privileged lab action.
Unpredictable Admin URLs Are Not Access Control
Public client-side JavaScript discloses the unpredictable administration path, and the server permits an unauthenticated visitor to use its privileged action.
Unprotected Admin Functionality: Forced Browsing to an Exposed Panel
The robots exclusion file reveals an administrative route that lacks server-side authorization, allowing direct access and the lab's deletion action.
Bypassing URL-Based Access Control with X-Original-URL
The front end blocks visible /admin paths, but the backend honors X-Original-URL when selecting a route. Sending an innocuous request target with the protected path in that header reaches the administrative action.
Sensitive Data Leakage in an Authorization Redirect
Requesting Carlos's account produces a redirect, but the server includes his API key in the 302 response body before the browser follows that redirect. Authorization must protect the response itself, not rely on navigation behavior.
Password Disclosure Through a User-Controlled Account ID
The account page trusts a user-controlled id parameter and renders the selected user's password into an HTML password field. Browser masking changes only presentation: the underlying value remains available to the client.
IDOR Despite Unpredictable User Identifiers
The account endpoint uses GUID-like identifiers rather than predictable usernames or integers. That makes guessing harder, but the application publishes Carlos's identifier in an author link.
Privilege Escalation Through Profile Mass Assignment
The profile endpoint binds extra client-supplied JSON properties while updating an email address. Its response exposes roleid, and adding "roleid": 2 to the request promotes the current account to administrator.