Engineering

Privilege Escalation Audit Prompt

Find the path from user to admin — audit for vertical and horizontal escalation: mass-assignment of roles, unchecked elevation, and operations that trust client-supplied privilege.

Open in Code Review Prompt Generator

Overview

Privilege escalation is when a normal user becomes more than they should be — by setting their own role in a form, hitting an admin route that forgot its check, or editing a record they horizontally shouldn't reach. This prompt audits for both vertical (user→admin) and horizontal (user→other user) escalation, focusing on the places privilege is assigned, changed, or assumed.

How to use this resource

Gather where privilege is assigned

Collect the code where roles are set, elevation happens, and records are accessed. The audit looks for the path from user to admin and from user to other user.
Open this resource in Code Review Prompt Generator

Load the prompt into Code Review Prompt Generator and paste in the code. It audits for both vertical and horizontal escalation rather than a generic pass.
Review the escalation findings

Read each finding - mass-assignment of a role, an admin route missing its check, an operation trusting client-supplied privilege - by severity.
Fix the paths and re-audit

Close each escalation path the audit names, then re-run it to confirm a normal user cannot become more than they should be.

Why This Works

Tracing escalation paths (from→to→via) makes findings concrete and fixable
Mass-assignment of roles is a common, severe, and easily-missed bug
Covering indirect/chained paths catches escalation no single-endpoint review would

Best for

Apps with roles, admin panels, or tiered privilege
Code that assigns or changes user permissions
Security review of privilege-sensitive flows

Not for

Designing the role model — use the RBAC Design Prompt
General broken-access-control — use the Authorization Review Prompt

Use cases

Auditing for user-to-admin escalation before launch
Checking role-assignment endpoints for over-grant
Finding mass-assignment that lets users set their own privilege

FAQ

How does the privilege escalation audit prompt tell vertical from horizontal escalation?

It splits the audit into distinct numbered checks. Only HORIZONTAL is named for the same-level case (a user acting on another user resources, the IDOR-flavored escalation), while MASS ASSIGNMENT, ELEVATION ENDPOINTS, UNCHECKED ADMIN PATHS and TRUST OF CLIENT DATA cover the user-to-admin direction. Each finding traces the path from what, to what, via what, returning findings only.

What is the difference between the Privilege Escalation Audit Prompt and a general authorization review?

This one hunts only escalation paths, so its notFor points you to the Authorization Review Prompt for general broken-access-control and the RBAC Design Prompt for designing the role model. It focuses on where privilege is assigned or assumed, forcing self-service role assignment and unchecked admin paths to CRITICAL rather than doing a broad access pass.

What code do I need to paste so the audit catches chained escalation like invite-self-as-admin?

Paste the user/role models, the endpoints that assign or change privilege, and the sensitive operations named in the INPUT block. INDIRECT PATHS only surfaces when the audit can see the full sequence, since its example (invite-self-as-admin) is where each step is allowed but the chain yields elevation. Missing endpoints leave that path invisible.

Does a clean run from the escalation audit prompt mean my app has no escalation paths?

It does not. Loading this into Code Review Prompt Generator outputs a review prompt you run in your own assistant; the findings-only, from-what/to-what/via-what report is a recommendation, not proof. Workflow step 4 has you fix each named path and re-audit, and you own confirming a normal user cannot become more than intended before shipping.

Customize This Resource

Opens this setup in Code Review Prompt Generator. Generate to get the full review contract — then adjust the focus, scope, language, and style.

Open in Code Review Prompt Generator

Prompt Template

Copy it as-is, or use Open in Code Review Prompt Generator to load it pre-filled and customize it with your own context.

ROLE
You are auditing code for privilege escalation paths — ways a user gains access beyond their intended level.

INPUT
[Paste the code: user/role models, the endpoints that assign or change privilege, and sensitive operations]

AUDIT FOR ESCALATION
1. MASS ASSIGNMENT: can a user set their own role, permissions, or tenant by including extra fields in a request the server trusts?
2. ELEVATION ENDPOINTS: every place privilege is granted or changed — is the actor authorized to grant it, and can they grant more than they hold?
3. UNCHECKED ADMIN PATHS: admin or privileged operations missing an authorization check.
4. HORIZONTAL: can a user act on another user's resources at the same privilege level (the IDOR-flavored escalation)?
5. TRUST OF CLIENT DATA: any privilege or role decision based on a value the client supplies rather than the server derives.
6. INDIRECT PATHS: chained operations where each is allowed but the sequence yields elevation (e.g. invite-self-as-admin).

SEVERITY
Tag [CRITICAL]/[MAJOR]/[MINOR]. Self-service role assignment and unchecked admin paths are CRITICAL.

OUTPUT
Findings by severity, each tracing the escalation path (from what, to what, via what). Findings only.

More resources from Code Review Prompt Generator

Resource

Code Review Prompt — the Review Contract

"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.

Prompt Engineering

Resource

Security Code Review Prompt

Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.

Engineering

Resource

API Review Checklist Prompt

Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.

Engineering

Resources that pair well

Resource

Refactor Prompt — the Behavior Preservation Contract

"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.

Prompt Engineering

Resource

Playwright Test Prompt

getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.

Engineering

Resource

Compare Two ChatGPT Prompts

A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.

Prompt Engineering

Related tools

Tool

Code Review Prompt Generator

Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.

Coding Workflows

Tip: Save time by exploring related resources and tools that integrate with this resource.