> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/server-side-vulnerabilities/access-control/user-id-controlled-by-request-parameter-with-unpredictable-user-ids.md).

# User ID controlled by request parameter, with unpredictable user IDs

#### [Horizontal privilege escalation](https://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/access-control-apprentice/access-control/horizontal-privilege-escalation)

## Description

This lab has a horizontal privilege escalation vulnerability on the user account page, but identifies users with GUIDs.

To solve the lab, find the GUID for `carlos`, then submit his API key as the solution.

You can log in to your own account using the following credentials: `wiener:peter`

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fsgq56CFwUyQ3jMPr67j3%2Fimage.png?alt=media&amp;token=60a3a9ef-c6b3-4df9-8687-2e169f4e8f0d" alt=""><figcaption></figcaption></figure>

we can start login as wiener user

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FqhRQAkHzT6R5MoNVijZL%2Fimage.png?alt=media&amp;token=d1222398-6f5c-4427-bd0f-65e7e1e27968" alt=""><figcaption></figcaption></figure>

we obtain Wiener's API Key.

We can try to return to Home page, and check if there're referrement to Carlos like as posts.

<https://0a3200fc04ca12b780505890009300fd.web-security-academy.net/post?postId=3>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FCMzzRfSomu01fcm3JtAw%2Fimage.png?alt=media&amp;token=6f82b06f-e88b-4dd8-9ce8-383be6ac0c27" alt=""><figcaption></figcaption></figure>

Capturing HTTP response we discover that userId value was changed

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F483PnftiTObcGQdLifrO%2Fimage.png?alt=media&amp;token=e3056cc8-6270-43aa-99bf-f15b267901c5" alt=""><figcaption></figcaption></figure>

Save it (Carlos userID): f26a0928-06ae-4b0d-be0a-ca03266160f0

Go back to My Account page and change the reference adding the new userID:

<https://0a3200fc04ca12b780505890009300fd.web-security-academy.net/my-account?id=f26a0928-06ae-4b0d-be0a-ca03266160f0>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FkHf1AOqObibXvAakVEjH%2Fimage.png?alt=media&amp;token=73b7dc31-7b7a-4e97-b840-f9bf5d10840d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Ficut38wezF3meHYnMZeH%2Fimage.png?alt=media&amp;token=b3689c49-2613-4c07-bc66-0f1520a54e37" alt=""><figcaption></figcaption></figure>

horizontal privilege escalation done!

Send the Carlos' API Key: NEvvgurN9IMYbP0WGQhRNxGCKLHuboPn

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F87AGSxo34rL8sa8VQ6v3%2Fimage.png?alt=media&amp;token=ca7fdadf-2be8-4de1-afd3-240a3c6a7f41" alt=""><figcaption></figcaption></figure>