Broken Object Level Authorization (BOLA) Vulnerability in OopsSec Store's Wishlist API

Challenge 6/36 focuses on Broken Access Control, specifically a Broken Object Level Authorization (BOLA) vulnerability. This medium-level authorization issue in OopsSec Store's wishlist API allows any logged-in user to read another user's private wishlist, including an admin wishlist containing the flag. The challenge is estimated to take 45–60 minutes. To start, spin up the lab using the command 'npx create-oss-store my-ctf-lab'. Additional resources include the roadmap, a walkthrough (to be read if stuck), and a GitHub repository for OopsSec Store.