Lab 304 — TeamVault — Broken Access Control in GraphQL Mutation

hackadvisor

Task: TeamVault workspace management platform with GraphQL API where temporary members are restricted from admin resources. Solution: GraphQL introspection reveals updateMemberAccess mutation lacking authorization checks, allowing any authenticated user to set their own isPermanent to true and access the Secrets Vault containing the flag.