Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request from the admin when the admin is promoting other users and I changed admin cookie or token with the normal user and that action is performed using normal user cookie.

Is this considered "privilege escalation"?

I asked this because if admin-accessible functionality is performed using a normal user cookie successfully so in order to exploit this scenario normal users only needed to find an endpoint for that functionality.

  • 1
    " I changed admin cookie or token with the normal user " -- how did you do this? While logged in as admin? We need a little more detail here.
    – schroeder
    Mar 16 at 12:23
  • @schroeder yes login with admin and perform some feature which is only accessible to admin and on that request change cookie or token with normal user Mar 24 at 9:26
  • So, no, that's not necessarily "escalation". That's potentially a failed "de-escalation". I think your test is faulty.
    – schroeder
    Mar 24 at 9:37

1 Answer 1


Assumption: You are testing a web application and have credentials for both admin and regular user. You tried an admin-only operation with the session cookie of a non-admin.

If it went through, then yes, that is a Vertical Privilege Escalation. You are correct that a normal user only needs to find the right endpoint to carry out the escalation and endpoint URLs cannot be considered secret in this case.

  • can bug bounty programs give rewards for finding this bug? Mar 17 at 7:06
  • absolutely they can.
    – mcgyver5
    Mar 17 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .