Privilege Escalation

Question

Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request from the admin when the admin is promoting other users and I changed admin cookie or token with the normal user and that action is performed using normal user cookie.

Is this considered "privilege escalation"?

I asked this because if admin-accessible functionality is performed using a normal user cookie successfully so in order to exploit this scenario normal users only needed to find an endpoint for that functionality.

Answer 1

Assumption: You are testing a web application and have credentials for both admin and regular user. You tried an admin-only operation with the session cookie of a non-admin.

If it went through, then yes, that is a Horizontal Privilege Escalation. You are correct that a normal user only needs to find the right endpoint to carry out the escalation and endpoint URLs cannot be considered secret in this case.