Progress

0 / 13 access controls broken this session (state is in-memory; runs under a single worker). Each item flips to done the moment the server accepts the unauthorized action. No flags — this module is graded on the checklist below.

⬜ IDOR (numeric) - read another user's order by id

⬜ IDOR via harvested id - list endpoint leaks others' ids/emails

⬜ Horizontal escalation - read another user's profile / invoice

⬜ Vertical escalation / BFLA - admin API function with no role check

⬜ HTTP method tampering - DELETE succeeds where GET is blocked

⬜ Method-override header - X-HTTP-Method-Override smuggles a verb

⬜ Mass assignment - profile update lets you set role / is_admin

⬜ Parameter-based access control - server trusts a client role param

⬜ URL/path bypass - case / trailing-slash defeats the /admin rule

⬜ Header spoof bypass - X-Original-URL / X-Rewrite-URL reaches admin

⬜ Referer-based check bypass - forge / drop Referer to enter

⬜ CORS misconfig - reflected Origin + credentials leaks protected data

⬜ Unauthenticated access - strip the session, endpoint still serves