Intermediate·300 points·0 solves
NoteGraph — GraphQL Introspection IDOR
Learn two GraphQL-specific issues that compound each other: leaving introspection enabled in production, which lets anyone enumerate the full schema including fields no page links to; and missing field-level / object-level authorization, where a resolver that takes an id argument returns that object's data for ANY id, not just the caller's own.
NoteGraph's GraphQL schema has a User type with a privateNote field. Nothing in the app's UI ever requests or displays privateNote for anyone but the signed-in user, but introspection is enabled, so a query against __type(name: "User") lists every field the type has, privateNote included — the schema itself is the leak. The deeper bug is in the user(id: ID!) resolver: it looks up whatever id you pass and returns the full object, with no check that the id belongs to the caller or that the caller has any right to it. So once you know the field exists, you query user(id: 1) { privateNote } and get back a note that was never meant to leave its owner's session. The fix is two separate changes: disable introspection outside development, and enforce authorization inside the resolver itself (or at the field level) rather than relying on the UI never asking for a sensitive field.
Your tasks
1
Run the default query
Open the lab and run the pre-filled query. It returns your own profile (guest, id 42) — username and publicBio, nothing sensitive.
2
Enumerate the schema
Introspection is enabled. Query __type(name: "User") { fields { name } } to list every field the User type has, not just the ones the UI uses.
3
Find the hidden field
Among the listed fields is privateNote — never referenced by the app's own UI, but a perfectly normal field in the schema.
4
Exploit the missing authorization
Query user(id: 1) { username privateNote } directly. The resolver returns it for any id, including the admin account (id 1) you are not signed in as.
5
Capture the flag
The admin user's privateNote is the flag.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.