You can read the task, take hints and check your answer — but nothing is saved. No XP, no skill points, and this task will not be marked complete.
`/invoice?id=4021` returns any invoice whose id is supplied, with no ownership check. Name this vulnerability class (four letters).
What this proves: Identify missing per-object authorisation.
Need assistance? You can reveal sequential hints. Each hint applies a minor penalty to your score.
If you are completely stuck, you can unlock the full step-by-step walkthrough.