Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request from the admin when the admin is promoting other users and I changed admin cookie or token with the normal user and that action is performed using normal user cookie.
Is this considered "privilege escalation"?
I asked this because if admin-accessible functionality is performed using a normal user cookie successfully so in order to exploit this scenario normal users only needed to find an endpoint for that functionality.