Lab: Multi-step process with no access control on one step
Summary: PortSwigger's Web Security Academy lab presents an admin panel whose multi-step user-role change process leaves one step without access control. The solution logs in as administrator:admin, promotes carlos, sends the confirmation request to Burp Repeater, then replays it with a non-admin session cookie and the username changed to the attacker's own.
What's compelling: The exploit needs only a low-privilege session cookie copied into a captured admin request, so a single unprotected step in a role-change workflow is enough for any logged-in user to promote themselves to administrator.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026