Here is my walkthrough of Passman.

This was a combination of GraphQL Mutation IDOR and SSTI.