# NoteGraph — GraphQL Introspection IDOR (lab)

> NoteGraph exposes a GraphQL API for personal notes. Introspection was left on, so the schema itself tells you about a field the UI never shows — and the resolver behind it will hand that field over…

Canonical: https://codelivly.com/labs/graphql-introspection-idor

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 0 |

NoteGraph exposes a GraphQL API for personal notes. Introspection was left on, so the schema itself tells you about a field the UI never shows — and the resolver behind it will hand that field over for any user id you ask for.

## Objective

Learn two GraphQL-specific issues that compound each other: leaving introspection enabled in production, which lets anyone enumerate the full schema including fields no page links to; and missing field-level / object-level authorization, where a resolver that takes an id argument returns that object's data for ANY id, not just the caller's own.

## Tasks

1. Run the default query
2. Enumerate the schema
3. Find the hidden field
4. Exploit the missing authorization
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)