⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A01 – Broken Access Control

OWASP A01:2025 CWE-22 CWE-200 CWE-548 CWE-639

Four different ways access control can fail. Each tab below isolates one CWE so you can focus on it. All four share the same root cause: the server trusts a user-supplied value to decide what data to return.

CWE-22 Path Traversal CWE-200 IDOR CWE-548 Directory Listing CWE-639 Privilege Key
CWE-639 Authorization Bypass via User-Controlled Key

The profile endpoint loads PROFILES[id]. The id comes from the URL, unsigned. Change the id, view anyone's profile — including the admin's.

Vulnerable code: 
return render(PROFILES[int(request.args['id'])])   # trusts the URL

Try it yourself

Your own profile

Submit 1. Alice viewing alice — expected.

Become someone privileged

Submit 99 — that's the admin's id.