Lab: Unprotected admin functionality with unpredictable URL

Summary: This PortSwigger Web Security Academy lab presents an application with an unprotected admin panel placed at an unpredictable location, but with that location disclosed somewhere in the application. The solution is to review the lab home page's source with Burp Suite or browser developer tools, find the JavaScript that discloses the admin panel URL, then load the panel and delete the user carlos.
Bottom line: Hiding an admin panel at an unguessable URL is not access control: the lab shows the address is disclosed in client-side JavaScript, so anyone who views the page source can reach the panel and delete a user.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026