User role can be modified in user profile

Platform: PortSwigger | Category: Access Control | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Access Control

Summary

Walkthrough of the PortSwigger Web Security Academy lab User role can be modified in user profile (Access Control). This lab demonstrates a access control vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Access Control

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

So as per the lab description, we can view the admin panel only if our roleID=2.

GET request to /myaccount -

Once we click my account link, the browser sends a req as follows.

GET request o /login -

This request retreives the login page to enter the username and password.

Login page -

Enter the credentials which are given for testing which is wiener:peter& click LOGIN button, the captured request is as follows

Now we have logged in as wiener,

Till now we didn't see any suspicious cookie values being sent from our client

Lets move on & try to update our email.

Request :

Send the request to repeater (I tried sending all the previous requests to repeater, it didn't have the roleid cookie either in request or response)

Response :

Observe that we have a roleid=1 in the JSON response.

So add the value roleid=2 in the JSON request & see what is the response in browser

We have a 302 redirect

Click Follow redirect,

Now we can see the link to Admin Panel in the browser.

Now click on admin panel & delete the carlos user to solve the lab.

Key Takeaways / Lessons

• Understanding Access Control detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: User role can be modified in user profile