Bug of the week #1: you can edit your profile. Can you reach the admin page?

Starting today, every Monday there is one new web security bug to find, free and without an account.

This week: Tasklane is a task app for small teams. You are signed in as Sam, a member of the Design team. GET /api/me returns your profile. You can change your display name. GET /api/admin/users answers 403 admin_only.

Your goal: get the admin user list as Sam, then change the server code so it can't happen again, and send both requests once more to prove the fix.

Rules: everything runs in your browser against a simulated API (*.example.test). Nothing touches a real system. It takes about 10 minutes.

Try it: Bug of the week #1 on Breachloom

I'll post a short write-up next Monday together with bug #2. If you solved it, tell me in the comments how long it took, but don't post the answer yet.