Lab: Referer-based access control
Summary: PortSwigger's Web Security Academy lab shows an application that gates admin functionality on the Referer header alone. A non-admin session request to /admin-roles?username=carlos&action=upgrade is rejected when the Referer header is absent, but replaying the same request with the non-admin's session cookie and the username changed to the attacker's own promotes that user to administrator.
Why it matters: A header the client fully controls was the only thing standing between a standard user and admin rights, so anyone who can set or copy a Referer value can promote themselves.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026