Lab: Method-based access control can be circumvented
Summary: PortSwigger's Web Security Academy lab shows an application that enforces access control partly on the HTTP method of a request, letting a non-admin user reach admin functionality by changing the request method. In the walkthrough, a request to promote user carlos is rejected with "Unauthorized" for the non-admin session, returns "missing parameter" when the method is changed from POST to POSTX, and succeeds after converting it to GET and setting the username parameter to the attacker's own account.
Key Takeaway: The control held only for the method the developer expected: switching POST to GET let a low-privileged user promote themselves to administrator, so any authorization check tied to request method rather than to the user's role is a privilege-escalation path.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026