Captcha bypass
Find out where the check happens - and whether it happens twice.
The lab 1
Also here 1
Nothing matches thatClear the filter to see everything again.
A captcha only works if the server checks it, checks it once, and ties it to the request it was issued for.
Authentication is who you are; authorisation is what you are allowed to touch. Broken access control is the app checking the first and forgetting the second, so an object id, a role field or a hidden admin route is all that stands between you and someone else's data.
Find out where the check happens - and whether it happens twice.