Lab: User ID controlled by request parameter, with unpredictable user IDs
Summary: PortSwigger's Web Security Academy lab presents a horizontal privilege escalation flaw on a user account page where users are identified by GUIDs rather than sequential IDs. The walkthrough has the tester find a blog post by carlos, note the GUID in his profile URL, log in as wiener, swap the id parameter to that GUID, and retrieve carlos's API key.
Bottom line: Unpredictable identifiers like GUIDs are often treated as a substitute for authorization checks, but here knowing one GUID is enough to read another user's account page and API key - so the control that matters is a server-side check that the requested record belongs to the authenticated user.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026