#IDOR

Trust Fall (Web) - PatriotCTF

A product-catalog app in PatriotCTF 2025 hid an IDOR vulnerability behind a hard-coded read-only token. By probing the backend API, user data could be accessed simply by changing the ID in the request. Enumerating those IDs eventually revealed the root profile, which exposed the flag and confirmed the app’s missing authorization controls.