Access control vulnerabilities and privilege escalation
Summary: PortSwigger's research describes broken access control as a common and often critical web vulnerability, splitting it into vertical controls (restricting sensitive functions to specific user types), horizontal controls (restricting resources to specific users), and context-dependent controls (restricting actions based on application state). It details how these break down: vertical privilege escalation through unenforced admin URLs, URLs leaked in robots.txt or JavaScript, role data stored in user-controllable cookies, and platform-layer bypasses via X-Original-URL headers, HTTP method tolerance, and path-matching quirks such as Spring's useSuffixPatternMatch, which was enabled by default prior to Spring 5.3.
What you should know: The article notes that access control design decisions have to be made by humans, so the potential for errors is high - and a single missed check on one step of a multi-step admin function, or one header the front end trusts, is enough to hand over the functionality.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026