User ID controlled by request parameter, with unpredictable user IDs

PortSwigger Web Security Academy lab: User ID controlled by request parameter, with unpredictable user IDs. Topic: Access Control Vulnerabilities.

$ tldr PortSwigger · Access Control Vulnerabilities

·	·
Platform	PortSwigger Web Security Academy
Topic	Access Control Vulnerabilities
Difficulty	APPRENTICE
Official lab	Open

Solve the lab

Language	Author	Format	Link
🇬🇧 EN	PortSwigger	Texto	Open
🇬🇧 EN	Rana Khalil	Vídeo	Open

Resources by skill

Skill	Source	Link
Access Control / IDOR	PortSwigger	Open

Related skills

Access Control / IDOR

---

Comments & tips

Solved this lab a different way? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07