Overview
Beyond object access, authorization testing checks role boundaries — whether users can perform actions above their privilege level (vertical escalation). This lesson covers testing role boundaries.
Learning objectives
- Define role boundaries and vertical privilege escalation.
- Explain testing role enforcement.
- Connect role-boundary flaws to impact.
Core concept
Role boundaries separate privilege levels — e.g. regular user vs administrator. A role-boundary flaw (vertical privilege escalation, from the web-security authorization module) occurs when a lower-privileged user can perform actions reserved for a higher role, because the application fails to enforce role checks on those actions. In bug bounty, testing role boundaries means verifying (with the researcher's own accounts at different privilege levels, where available) that privileged actions are actually restricted — a missing role check letting a normal user do admin actions is a high-impact finding.
How it works
Using test accounts at different privilege levels (or a single lower-privileged test account attempting privileged actions), the researcher checks whether the application enforces role checks on privileged functionality: can a regular user invoke an admin action (via the UI, or by calling the underlying endpoint directly)? A common flaw is protecting a privileged action only in the UI (hiding a button) while leaving the endpoint unprotected — so a lower-privileged user calling it directly succeeds. The researcher tests these attempts safely with their own accounts, documenting any privileged action that succeeds without proper role as a finding. As always, testing stays in-scope and uses test accounts.
Practical example
Testing an in-scope application with a regular-user test account, the researcher finds that while the admin function is hidden from the UI for regular users, the underlying endpoint does not check the role — so the regular user, calling it directly, can perform the admin action. This is a vertical privilege escalation (role-boundary) finding, documented with reproduction (using the researcher's own regular-user account) and a fix (enforce role checks on the endpoint, not just the UI). A high-impact finding, tested responsibly.
Cybersecurity relevance
Role-boundary flaws (vertical privilege escalation) are high-impact bug bounty findings — a normal user gaining admin capabilities can be critical — and are common where role checks are enforced only in the UI, not on the endpoints (a classic broken-access-control pattern from the web-security authorization module). Testing verifies role enforcement using the researcher's own accounts, in-scope. Findings drive server-side role checks on all privileged actions. Combined with object-level (IDOR/BOLA) testing, role-boundary testing covers the two main authorization flaw directions — a high-value area.
Common mistakes
- Assuming a hidden UI action is protected, without testing the underlying endpoint.
- Not testing privileged actions from a lower-privileged account.
- Overlooking role checks on APIs/endpoints (vs just the UI).
Key takeaways
- Role boundaries separate privilege levels; a role-boundary flaw (vertical escalation) lets a lower-privileged user perform higher-role actions due to missing role enforcement.
- A common pattern is protecting privileged actions only in the UI while leaving endpoints unprotected — test the endpoints directly with a lower-privileged test account.
- Findings are high-impact and drive server-side role checks on all privileged actions; with IDOR/BOLA testing, this covers both authorization flaw directions.
Check your understanding
- What is a role-boundary (vertical escalation) flaw, and what common pattern causes it?
- Why must privileged actions be tested at the endpoint level, not just the UI?