# HelpHub — IDOR / Broken Access Control (CTF challenge)

> HelpHub's support desk lets agents view their own tickets — but the viewer only checks that you're logged in, not that the ticket is yours.

Canonical: https://codelivly.com/ctf/challenges/helphub-idor

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Easy |
| Points | 120 |
| Estimated time | 20 min |
| Type | Live instance |
| Solves | 57 |
| Author | Codelivly |

HelpHub's support desk lets agents view their own tickets — but the viewer only checks that you're logged in, not that the ticket is yours. Log in as alice / alice123 and read the administrator's confidential ticket.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)