Lab: Weak isolation on dual-use endpoint
Summary: PortSwigger's lab presents a web application that assumes a user's privilege level based on their input, letting an attacker exploit the logic of its account management features to reach arbitrary users' accounts. The stated goal is to access the administrator account and delete the user carlos, starting from the provided credentials wiener:peter.
Key Takeaway: The flaw is a trust decision made on input the user controls, and the lab's payoff is deleting another account entirely - the kind of logic error that no signature-based scanner rule catches on its own.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026