User ID controlled by request parameter

Platform: PortSwigger | Category: Access Control | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Access Control

Summary

Walkthrough of the PortSwigger Web Security Academy lab User ID controlled by request parameter (Access Control). This lab demonstrates a access control vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Access Control

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

When ther lab loads , we see the usual shopping website. Clicking on My account takes us to a login page.

We enter the credentials which is given in the lab description - wiener:peter

When we login we get to see the API key of wiener - T9VQGi3yf81cho2IzdP5jN61hT9zc1YA

To solve the lab , we need to retreive the API key of carlos user.

When we click on My Account after loggin in as wiener, a request is sent like this

It contains ?id=wiener parameter.

Change the value to carlos , we get the API key of carlos and thus solved the lab

Key Takeaways / Lessons

• Understanding Access Control detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: User ID controlled by request parameter