Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request from the admin when the admin is promoting other users and I changed admin cookie or token with the normal user and that action is performed using normal user cookie.

Is this considered "privilege escalation"?

I asked this because if admin-accessible functionality is performed using a normal user cookie successfully so in order to exploit this scenario normal users only needed to find an endpoint for that functionality.

  • 1
    " I changed admin cookie or token with the normal user " -- how did you do this? While logged in as admin? We need a little more detail here.
    – schroeder
    Mar 16 at 12:23
  • I assume he has credentials for both and used a web proxy to switch the cookie in the admin's request with his non-admin cookie. This is a scenario when testing web applications. If the operation was successful, then that is indeed a "Horizontal" privilege escalation.
    – mcgyver5
    Mar 16 at 18:33
  • @schroeder yes login with admin and perform some feature which is only accessible to admin and on that request change cookie or token with normal user yesterday
  • So, no, that's not necessarily "escalation". That's potentially a failed "de-escalation". I think your test is faulty.
    – schroeder

1 Answer 1


Assumption: You are testing a web application and have credentials for both admin and regular user. You tried an admin-only operation with the session cookie of a non-admin.

If it went through, then yes, that is a Horizontal Privilege Escalation. You are correct that a normal user only needs to find the right endpoint to carry out the escalation and endpoint URLs cannot be considered secret in this case.

  • can bug bounty programs give rewards for finding this bug? Mar 17 at 7:06
  • absolutely they can.
    – mcgyver5
    Mar 17 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.