Lab: User role can be modified in user profile
Summary: PortSwigger's Web Security Academy lab presents an admin panel at /admin that is restricted to logged-in users with a roleid of 2. The solution shows that after logging in as wiener:peter and updating the account email, the response returns the user's role ID, and adding "roleid":2 to the JSON request body changes the account's roleid to 2, granting access to /admin to delete the user carlos.
Key Takeaway: The role identifier is accepted from the client in the same JSON body used for a routine email update, so a single added field moves a standard user to administrator - a privilege escalation that requires no exploit tooling, only a proxy and one edited request.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026