User role controlled by request parameter

Platform: PortSwigger | Category: Access Control | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Access Control

Summary

Walkthrough of the PortSwigger Web Security Academy lab User role controlled by request parameter (Access Control). This lab demonstrates a access control vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Access Control

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Some applications determine the user's access rights or role at login, and then store this information in a user-controllable location, such as a hidden field, cookie, or preset query string parameter. The application makes subsequent access control decisions based on the submitted value. For example:

• https://insecure-website.com/login/home.jsp?admin=true
• https://insecure-website.com/login/home.jsp?role=1

This approach is fundamentally insecure because a user can simply modify the value and gain access to functionality to which they are not authorized, such as administrative functions.

Steps -

We have our login page,

In the lab description , it is given that the admin page is at /admin. Lets try visiting that page.

It says we can view only if we are admin!

We have a login credential wiener:peter .Lets try logging in and see what requests & responses being made.

Once we hit login after entering username and password, it sends a POST request like this,

Then a GET request is made to retreive the /myaccount page .

Here we have an interesting cookie - Admin=false.

The reponse looks like this ,

We are logged in as wiener

What happens if we change the cookie value to Admin=true ?

We modify all the requests where the cookie is set to Admin=false to Admin=true`

POST req to /login endpoint

GET req to /myaccount endpoint

GET req to /admin endpoint

After getting the myaccount page, we click the Admin panel link, the request sent is modified as follows

Atlast, we get the admin panel .

Now we can delete the suer carlos and solve the lab.

GET req to /admin/delete endpoint

Capture the request to delete the user carlos & change the cookie value here too!

We have sucessfully solved the lab.

Key Takeaways / Lessons

• Understanding Access Control detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: User role controlled by request parameter