privesc-hunter

Capture a harmless reversible admin action, replay it as a low-privilege user against the same endpoint or an alternate API channel, then verify the state change with an admin read. Confirm the actor gained a higher-role capability, not just access to another object.

Privilege escalation means the actor gains or exercises a capability reserved for a higher role, even without touching a foreign object ID. Cross-user object access without acquiring a higher role is an access-control or IDOR issue, not privilege escalation.

Yes, if the server trusts client-controlled role fields like role, permission, or capability during registration or update. Verify elevation through the authoritative role API or database, not just a reflected field, and only test on disposable or admin-controlled instances.

Do not report when the behavior is expected product design, a later authoritative check rejects the action, escalation requires prior admin control, only a label changes without proven capability, or the affected asset is out of scope. Apply the negative-control taxonomy categories before filing.

The version boundary table lists fixed versions for known GHSA and CVE authorization flaws in Spring Security, Django, Parse Server, and Directus. If the target runs at or above the fixed version, focus on custom roles and endpoint guards instead of the patched component.