Scenario

PATCH /api/users/{id} updates your profile. The GET of the same object returns more fields than the edit form shows.

Your objective

Escalate your account to administrator via the update endpoint and access an admin-only route. Solved when you delete the user carlos through the admin API.

Capture 2 flag(s) and record the exact technique for each step.

Getting started

1. GET your own user object and note every field, especially anything role/permission shaped.
2. PATCH a legitimate field plus the suspicious one (e.g. roleid) and check it is accepted.
3. Find the admin role value (enumerate small integers, or read /api/roles).
4. PATCH {"roleid": <admin>} and confirm an admin route now returns 200.
5. Submit the hidden field name and the admin role value as the two flags.

Connecting

Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.

Credentials: wiener:peter

Hints