BSCP
Burp Suite Certified Practitioner (BSCP)
Access ControlEnglish
Exam overviewPractice session
During API testing, you discover an endpoint `/api/v1/user/123/profile` returns only `name` and `email`. By sending a GET to `/api/v1/user/124/profile`, you successfully retrieve another user's profile. Which access control vulnerability is this?
Loading your practice session…