Forged Feedback

Difficulty: 🌟🌟🌟

Description: Post some feedback in another user's name.

Category: Broken Access Control

Tags: Tutorial

Solution:

Logged in another user account, e.g: admin account, and open the page Feedback with a new tab. Then navigate back to the dashboard and log out. After logging out, navigate back to the Feedback page, you will see the feedback submission still have the author is your logged out admin email ⁉️: