Horizontal Privilege Escalation

CRITICAL CWE-639 · Authorization Bypass Through User-Controlled Key

Description

Detects when user-controlled input is used to access resources belonging to other users at the same privilege level without verifying ownership.

What Shoulder detects

User-controlled input from {source} flows to {sink} without ownership verification.

How to fix

Filter queries by authenticated user ID to verify ownership.

```javascript
const profile = await User.findOne({
  where: { id: req.params.userId, userId: req.user.id }
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-639/horizontal-privilege-escalation

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express fastify nextjs koa hapi nestjs

References

Documentation ↗ OWASP ↗ Learn about CWE-639

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-horizontal-privilege-escalation .