Source: Hacker News
Authorization checks, 15 minutes, no tool
Change the number in the URL Log in as A, copy any URL with an id. `/invoice/1042`, `?user_id=7`. If B sees A's data you don't have authorization, you have a login screen. Meta paid $78k for one of these this year.2.
Key Points
- Change the number in the URL Log in as A, copy any URL with an id. `/invoice/1042`, `?user_id=7`.
- If B sees A's data you don't have authorization, you have a login screen.
- Meta paid $78k for one of these this year.2.
Published: August 21, 2026 11:33 am
Source: Hacker News