Testing for parameter-based access control - Port Swigger
Summary: PortSwigger Research describes sites that base access controls on request parameters, such as a role_id value that determines whether a user is treated as having admin privileges in the response. It notes these parameters may not bypass server-side controls but can still get past client-side ones and reveal attack surface like an admin page that can be viewed but not necessarily interacted with, and it walks through testing them with Burp Suite's match and replace rules to swap values such as false for true.
Bottom line: A parameter like role_id that decides how a response is rendered can expose an admin page to anyone who flips its value, even when the server still blocks the underlying actions.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026