Trying to fuzz the post id query param we get to a 404 displaying:

Also, we notice that the creation of post generate a random post id.

Once a post is created, we can grant the edit to other user.

Using Burp suite, we can intercept the request and grant ourselves edit on any post using its ID (the session cookie seems to be bypassed).

Realizing the id generated are often in the thousand, out of curiosity, I try visiting the blog post with the id 1337 which just says: You don't have the permission to see this content.

Using the grant hack we found earlier we grant ourselves the edit on the post with id 1337 and get the flag.

🏴Flag

flag{5a593f66535c10f2291a8dcb8e88bfbb}