← All labs
Modern Level 8 / 8 Medium

Mass Assignment / Privesc

A profile-update endpoint trusts your fields. Make yourself an admin.

Edit your profile

Update your display name and bio. The form posts to a profile-update endpoint that saves your fields. Ordinary users cannot be admins… through the form.

Saved profile

name: youbio: role: user

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.