Testing horizontal access controls - Port Swigger
Summary: PortSwigger's guidance describes testing horizontal access controls by obtaining credentials for two accounts with identical privileges and swapping the second user's session cookie into requests made as the first user. It notes that testing many endpoints manually is time-consuming, and recommends automating the swap across the site map with a Burp session handling rule or the Autorize extension from the BApp Store.
What you should know: The failure mode described is a logged-in user reaching data and functionality that should belong only to other users - a gap that exists whenever access controls are set incorrectly, and one that only shows up if someone actually tests it with a second account.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026