Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection

hackadvisor

Task: API management platform with regex-based authorization middleware protecting admin routes. Solution: Logged in as developer, discovered admin endpoints via robots.txt, accessed /api/v1/admin/users directly — regex auth middleware failed to enforce admin role check, exposing flag in user table.