Broken Access Control Leading to Privilege Escalation

UpdatedJanuary 16, 2026

•2 min read•View as Markdown

Broken Access Control Leading to Privilege Escalation

Cyber Sekler

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Password Reset Poisoning Leading to Account Takeover

Overview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...

Jan 16, 20262 min read

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

During a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc...

Dec 16, 20252 min read

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Overview During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding ...

Nov 16, 20242 min read

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Web Application Account Compromise via 2FA Bypass

Overview During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (...

Jul 9, 20242 min read

Web Application Account Compromise via 2FA Bypass

Cyber Sekler

7 posts

Overview

During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full control over user roles. This matters because access control failures like this can collapse trust boundaries with very little effort.

Discovery

To identify access control weaknesses, I logged into the application using both the low-privileged user account and the administrator account. I then compared available functionality between the two roles to understand which features were intended to be restricted to administrators.

Using Burp Suite with the Autorize extension enabled, I browsed the application as the administrator while replaying requests using the low-privileged user’s session cookies. During this process, I paid close attention to response behaviour, particularly response content length.

Several admin-only endpoints returned responses with identical content lengths when accessed using low-privileged credentials. This was a strong indicator that access control checks were either missing or incorrectly enforced. I noted these endpoints for further testing.

After identifying the endpoints that behaved similarly for both roles, I manually replayed the admin-specific requests using the low-privileged user account. The application did not prevent access to these endpoints and returned valid responses.

One of the affected endpoints controlled user role management functionality. By accessing this endpoint as a low-privileged user, I was able to modify user privilege levels. This allowed me to grant administrative privileges to my own account as well as to other registered users.

Although tooling such as Autorize helped surface the issue quickly, the underlying problem was a lack of server-side access control enforcement. The application trusted the request regardless of the authenticated user’s role, enabling privilege escalation.

Broken Access Control Leading to Privilege Escalation

Comments

More from this blog

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Web Application Account Compromise via 2FA Bypass

Overview

Objective

Discovery

Takeaway

Command Palette

Comments

More from this blog

Overview

Objective

Discovery

Takeaway