Managing roles locally - Port Swigger
Summary: PortSwigger's documentation for Burp Suite DAST describes built-in roles such as Administrator and Scan initiator, alongside custom roles that define sets of permissions matching team job functions. It warns that permissions like Modify settings or Manage extensions may let users create new users or upload malicious extensions, and that some permissions depend on others, such as edit requiring view.
Bottom line: A role granted the Manage extensions permission can upload a malicious extension, so the permission set on a single custom role can hand a user a path to privilege escalation your infrastructure may not contain.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026