Unprotected admin functionality with unpredictable URL

Platform: PortSwigger | Category: Access Control | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Access Control

Summary

Walkthrough of the PortSwigger Web Security Academy lab Unprotected admin functionality with unpredictable URL (Access Control). This lab demonstrates a access control vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Access Control

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

The lab webpage looks like this,

Clicking on My Account, takes us to the Login page at /login.

On seeing the source code, we see a javascript code which checks if the user is admin, then it redirects us to /admin-59c6c7 endpoint which is the admin panel.

So we could directly browse to that directory to view the admin panel.

Click on ther DELETE link of carlos to delete the carlos user .Thus lab is solved.

Key Takeaways / Lessons

• Understanding Access Control detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Unprotected admin functionality with unpredictable URL