Authentication → Authorization → Privilege Escalation

Scanners collapse identity failures into one severity. Researchers separate three questions. Did the request prove an identity? Did that identity own the object? Can that object or role reach a privileged operation?

This note is the laboratory’s identity spine. It is not an exploit script for a login form.

Authentication failure: a request is treated as a known principal without a valid proof. Authorization failure: a valid principal can act on another tenant’s object. Privilege escalation: a low-privilege principal can invoke an operation reserved for a higher role.

Multi-tenant SaaS, admin APIs, mobile backends, and any service that binds a resource ID from the client. Internal RPC that reuses the same identifiers without a service identity is in scope.

Object IDs in paths and bodies, role fields the client can set, “view as” and impersonation features, password-reset and invite tokens, and admin export jobs.

The failed assumption is usually “the caller who knows the identifier is the owner,” or “the framework middleware already checked this object.” Root cause is a missing predicate at the object or operation, not the absence of a login page.

Always draw identity before impact. Skipping a box is how IDOR gets sold as RCE.

Identity bugs become RCE only when the privileged operation is itself an execution sink — plugin install, template edit, deserialization admin, or a debug console. Most remain data-access or state-change findings. Record the actual last hop.

Look for new ownership checks, removal of client-supplied roles, and central policy helpers. If the patch checks one route and siblings still take a raw ID, the invariant is not systemic.

In review: every handler that takes a resource ID must show an ownership or role check. In logs: access denials that never fire on object routes are a smell. In tests: two-tenant fixtures are mandatory.

Authorize on the server with the session’s tenant, not the client’s advertised org. Hide raw sequential IDs if they are only a convenience — but do not treat hiding as authorization. Split admin execution features onto a separate control plane.

Write the hop. Authentication without authorization is a half-finding. Authorization without a privilege story is how severity gets invented.

OWASP API Security — object-level and function-level authorization.

CWE-285, CWE-639, CWE-269 — after the hop is identified.

Art of Vector Security disclosure policy — /about/responsible-disclosure.