# Gridline — Broken Access Control (lab)

> Gridline is an internal operations console. You are signed in as a read-only guest, and the admin console is never linked in the interface — but nothing actually stops you from visiting it.

Canonical: https://codelivly.com/labs/broken-access-control

| | |
|---|---|
| Type | Web |
| Difficulty | Beginner |
| Points | 100 |
| Session length | 30 min |
| Completions | 44 |

Gridline is an internal operations console. You are signed in as a read-only guest, and the admin console is never linked in the interface — but nothing actually stops you from visiting it. Find the unprotected admin area and read the master operations key.

## Objective

Learn broken access control (missing function-level authorization): when a privileged page relies on simply not being linked rather than on an auth check, anyone who finds the URL can use it.

## Tasks

1. Look around as a guest
2. Check recon sources
3. Visit the hidden area directly
4. Read the admin dashboard
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)