Account settings
Edit your display name and bio. Behind the form, the page loads and saves your whole profile as a
single object through /api/profile. Ordinary users can't be admins… through the form.
Inspect what the page loads → GET /api/profile
The form submits only name and
bio. Saving any other field means adding it to the POST body yourself.
GET /api/profile — the object the settings page loads to render your account
The form only edits two of these fields — but the same object is what gets sent back when you save.
Current profile
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.