中文 English Français Русский Español العربية

Bug of the week #1: you can edit your profile. Can you reach the admin page?

dev.to Beginners2026-11-02 22:000 views

Starting today, every Monday there is one new web security bug to find, free and without an account.

This week: Tasklane is a task app for small teams. You are signed in as Sam, a member of the Design team. GET /api/me returns your profile. You can change your display name. GET /api/admin/users answers 403 admin_only.

Your goal: get the admin user list as Sam, then change the server code so it can't happen again, and send both requests once more to prove the fix.

Rules: everything runs in your browser against a simulated API (*.example.test). Nothing touches a real system. It takes about 10 minutes.

Try it: Bug of the week #1 on Breachloom

I'll post a short write-up next Monday together with bug #2. If you solved it, tell me in the comments how long it took, but don't post the answer yet.

Source：https://dev.to/ookeolioli222/bug-of-the-week-1-you-can-edit-your-profile-can-you-reach-the-admin-page-1nbb

My favorites

PreviousTesting and rebuilding Node.js snapshot artifacts after CVE-2026-106074 NextCómo hacer copias de seguridad sin complicarte la vida

find -size -1M Matched Only the Empty File: Size Units in a Camera Clip Cleanup Script

A cleanup job for a folder of camera clips had one line meant to remove the broken stubs a recorder leaves behind when i

0dev.to

Mastering Background Tasks in Flutter: Efficient Data Sync & UI Updates

1. Introduction & The Problem Modern mobile applications are expected to be fast, responsive, and data-consistent. Howev

0dev.to

Remove a Photo Background in the Browser: An On-Device Model, No Upload

I work on OnePassApps. We build browser studios that process files in the tab instead of uploading them, and this is the

0dev.to

My morning terminal: zoxide jumps, mise runs the project, starship shows context, fzf picks the file

You open a terminal many times every day, and most of the time, you follow the same five-minute sequence: get to your cu

0dev.to

A stale translation passes every check and still tells a different story

Development covered 24 Sep 2026 to 25 Sep 2026 (commit dates). Myriad Immortal Sect ships in eleven languages. I write t

0dev.to

NYT and publishers sue Brave over AI content scraping

📅 2 November 2026 • TechCrunch / TNW The New York Times has filed a lawsuit against Brave Software in federal court in M

0dev.to

Bug of the week #1: you can edit your profile. Can you reach the admin page?

Related posts

find -size -1M Matched Only the Empty File: Size Units in a Camera Clip Cleanup Script

Mastering Background Tasks in Flutter: Efficient Data Sync & UI Updates

Remove a Photo Background in the Browser: An On-Device Model, No Upload

My morning terminal: zoxide jumps, mise runs the project, starship shows context, fzf picks the file

A stale translation passes every check and still tells a different story

NYT and publishers sue Brave over AI content scraping