Summary
Unprotected admin functionality — PortSwigger Access control vulnerabilities Lab 1 Finding ID: BAC-Portswigger-001 Title: Unprotected Admin Functionality Risk (Severity): High Rationale: The application exposes an administrative interface that is accessible without authentication. The admin panel path is disclosed through the robots.txt file and is not protected by any server-side authorization checks. An attacker can directly access the admin panel and perform sensitive actions such as deleting user accounts, leading to full compromise of the application. Affected asset / Location:/administrator-panel (Admin panel endpoint) Root cause: Missing authentication and authorization checks on administrative functionality. The application relies on obscurity instead of enforcing proper access control. Discovery date: 2025–12–30 Executive Summary : The application contains an unprotected admin panel that can be discovered by viewing the robots.txt file. Any unauthenticated user can access the admin interface and execute privileged actions, including deleting users. This represents a clear case of Broken Access Control and allows complete administrative takeover of the application.Press enter or click to view image in full size Reproducible Steps (PoC — Lab Only) :
- First, open the target lab in a browser, read lab description carefully.
- Next, access the lab …
- Append /robots.txt to the lab URL:
- Observe that the file reveals a hidden admin path: Disallow: /administrator-panel
- Replace /robots.txt with the disclosed path: https://LAB-ID.web-security-academy.net/administrator-panel
- Confirm that the admin panel loads without authentication and locate the user list. Get Zeyad Naguib’s stories in your inbox Join Medium for free to get updates from this writer.
- Click Delete next to the user carlos.
- The user is successfully deleted, solving the lab. Impact :
- Unauthorized access to administrative functionality
- Ability to delete or modify user accounts
- Full compromise of application security
- Clear exploitation of Broken Access Control Remediation (Recommended) :
- Enforce Authentication Require login before accessing any admin endpoints. - Implement Authorization Checks Ensure only privileged users can perform administrative actions. - Do Not Rely on robots.txt robots.txt must never be used to protect sensitive paths. - Apply Role-Based Access Control (RBAC) Validate permissions on every sensitive request. - Regular Security Testing Include access control testing in security assessments. References :
- OWASP Top 10 — A01: Broken Access Control https://owasp.org/Top10/A01_2021-Broken_Access_Control/https://portswigger.net/web-security/access-control