Privilege escalation is gaining access to operations or resources beyond those authorized for a user, service, or process. In APIs, it commonly means a normal user reaching an administrator-only endpoint because role checks are weak, missing, or inconsistently applied. section 4.7
The vertical form crosses role boundaries, such as a student requesting GET /admin/students. Horizontal escalation is different: a user accesses another user’s data while keeping the same role, known as broken object-level authorization (BOLA). section 12.1 section 4.7
A role-check failure
A normal user obtains an access token and sends it to GET /admin/students. If the endpoint checks authentication but not the token’s role, the request can expose sensitive student data. A focused regression test should expect 403 Forbidden for that request. section 12.4
Escalation can also arise through chained weaknesses. An SSRF-prone avatar endpoint may let an attacker send an internal request from the user service to an admin service. Missing input sanitization, weak service authorization, and absent network segmentation can turn that request into access to sensitive data. section 1.1
Reduce privilege-escalation risk by checking:
- Whether every admin, developer, or similarly sensitive operation verifies the caller’s role on every request; hiding an endpoint or placing it on a special path is not an access control. section 4.7
- Whether access tokens explicitly carry roles and whether authorization rejects roles that lack the required permission. section 4.7
- Whether request fields are constrained instead of copied blindly into database models; mass assignment can let users change payment status, discounts, or access privileges. section 4.6.1
- Whether service-to-service traffic is restricted through input validation, access controls, and network segmentation. section 1.1
Test the threat model with unauthenticated, malformed, expired, tampered, wrong-role, and wrong-owner requests. Group checks into authentication, BOLA, RBAC, and attribute-based authorization tests, then run them as regression tests and use production threat detection to identify suspicious behavior. section 12.4 section 12.1
Figure 4.15 A good strategy to prevent BFLA is to declare user roles explicitly in access tokens and check those roles on every request across all operations.
Use the diagram to connect explicit roles in access tokens with authorization checks applied across every API operation. section 4.7
