# Ledgerly — Insecure Direct Object Reference (lab)

> Ledgerly shows your invoices by id in the URL, but never checks the invoice is actually yours. Change the id and read someone else's. The flag is on the CEO's invoice.

Canonical: https://codelivly.com/labs/idor

| | |
|---|---|
| Type | Web |
| Difficulty | Beginner |
| Points | 150 |
| Session length | 30 min |
| Completions | 31 |

Ledgerly shows your invoices by id in the URL, but never checks the invoice is actually yours. Change the id and read someone else's. The flag is on the CEO's invoice.

## Objective

Learn Insecure Direct Object Reference (IDOR): when a page fetches a record by id but forgets to check you are allowed to see THAT record, you can read other people's data by changing the id.

## Tasks

1. Open the portal
2. Change the id
3. Find the interesting account
4. Read the CEO's invoice
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)