Privilege Escalation
HighPrivilege Escalation
Definition
Privilege Escalation is the process of obtaining permissions or roles higher than those originally assigned. It splits into horizontal (accessing another same-level user's resources) and vertical (obtaining higher-level permissions, such as from user to admin). It is one of the most sought-after impacts in bug bounty for its severity.
Impact
Access to administrator featuresReading and modifying other users' dataControl over the application's configurationAbility to create or delete accountsAccess to admin panels and internal tools
Examples
Vertical escalation: user to admin
Vertical escalation happens when an admin endpoint does not properly verify the requester's role. The attacker, as a normal user, can invoke admin functions if the server only checks that the token is valid without checking the role.
# 1. Register a normal account
POST /api/auth/register
{"username": "hunter", "email": "hunter@test.com", "password": "test123"}
# 2. Inspect the decoded JWT in the response
{
"userId": "abc123",
"role": "user",
"iat": 1713262800
}
# 3. Find an endpoint with no role check
PUT /api/admin/users/abc123/role
Authorization: Bearer <normal_user_token>
{"role": "admin"}
# If the endpoint doesn't verify that the requester is an admin,
# the user promotes themselves to admin