---
title: Privilege Escalation
category: concepts
created: 2026-12-21
updated: 2026-12-21
tags: [privilege-escalation, security-vulnerability, authentication-bypass, url-manipulation, access-control, web-security]
sources: [raw/conversations/2026-02-26-cursor-assistant-rh-01d2e916.md]
confidence: high
---

# Privilege Escalation

Security vulnerability where an attacker gains elevated privileges or access rights beyond their intended authorization level. In web applications, this often occurs through authentication bypass, parameter manipulation, or session hijacking.

## Common Attack Vectors

### URL Parameter Manipulation

Attackers modify URL parameters to assume different user roles or permissions:

Normal user access

https://app.example.com/dashboard?group=user

Escalated admin access

https://app.example.com/dashboard?group=admin

**Risk Factors:**
- Client-side role determination
- Lack of server-side validation
- Cookie-based privilege storage without verification

### Session Token Manipulation

Modification of session cookies or tokens to gain unauthorized access:

```javascript
// Vulnerable cookie handling
if (cookies.get("user_group") === "admin") {
    grantAdminAccess();
}

Prevention Strategies

Server-Side Validation

Always validate privileges server-side:

def check_admin_access(user_id):
    # Query database for actual user role
    user = get_user_from_database(user_id)
    return user.role == 'admin' and user.is_active

Role-Based Access Control (RBAC)

• Store user roles in secure backend database
• Validate permissions on every protected operation
• Implement principle of least privilege
• Use secure session management

Input Validation

• Sanitize all user inputs including URL parameters
• Implement allow-lists for valid parameter values
• Reject requests with suspicious parameter combinations

Case Study: Assistant-RH Vulnerability

The assistant-rh project contained a critical privilege escalation vulnerability:

Vulnerable Code:

# URL parameter directly sets user group
url_group = query_params.get("group", "").lower()
if url_group:
    return url_group, True

# Cookie check without validation
if cookies.get("user_group") == ADMIN_GROUP:
    st.session_state.admin_authenticated = True

Impact:

• Any user could become admin by adding ?group=dgafpallianceadmin to URL
• No password or authentication required
• Full administrative access to sensitive HR data

Detection and Monitoring

Security Auditing

• Log all privilege escalation attempts
• Monitor for suspicious URL parameter patterns
• Track admin access patterns and anomalies
• Implement rate limiting on authentication endpoints

Penetration Testing

• Test all user role transitions
• Verify parameter tampering protections
• Validate session management security
• Check for horizontal and vertical privilege escalation

See also

• authentication-flows - User authentication mechanisms
• security-vulnerabilities - Common web security issues
• access-control - Authorization and permission systems
• web-security - Web application security practices