GraphQL IDOR

Scenario

PeopleGraph lets clients query user records by id through a GraphQL API. Each user object includes a secret field meant for HR only. Retrieve the administrator's secret without authorisation.

Your approach

1. Open the GraphQL IDE or POST endpoint and explore the schema.
2. Query user objects with different numeric ids.
3. Request the secret field on the admin user's record.
4. Copy the admin secret flag from the response.
5. Submit that flag.