Debug Build Hunt ∞Spot the Bug DSA Learn 3D Lab Progress

Admin Panel Access Control

MediumNode · Express · Jest

00:00 / 25:00

SEC-140 · P0 · Privilege escalation in admin API

Pen-test found that any logged-in customer can call admin endpoints. Anonymous calls return 500 instead of 401. Separately, an admin managed to delete their own account, locking the team out.

Concepts

authn vs authzmiddleware order= vs ===ObjectId equality

Workflow that wins the OA: run the tests → read the first failure → open the file it points to → form one hypothesis → change one thing → rerun. Use the Request flow tab to see exactly which middleware/handler/DB calls ran.

Explorer

middleware

models

routes

tests

No run yet

Press ⌘/Ctrl + Enter or Run tests