Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

Registration verifies an email address, but /my-account/change-email immediately trusts a replacement. Setting [email protected] satisfies the domain-only /admin rule.

Lab overview identifies email-domain authorization for `/admin` and the weaker unverified change-email path.
Lab overview identifies email-domain authorization for `/admin` and the weaker unverified change-email path.

Lab objective/setup

This intentionally vulnerable Academy exercise isolates inconsistent security controls. The supplied accounts and endpoints are used to reproduce only the source note evidence for inconsistent security controls; all request changes remain inside this Academy instance.

What I observed

Registration verifies an email address, but /my-account/change-email immediately trusts a replacement. Setting [email protected] satisfies the domain-only /admin rule.

Email client displays the account registration confirmation message sent to the initial address.
Email client displays the account registration confirmation message sent to the initial address.
Account page shows the registered user is active and that replacement email addresses take effect without verification.
Account page shows the registered user is active and that replacement email addresses take effect without verification.

Why it is vulnerable

Equivalent state changes must enforce identical security invariants regardless of which endpoint performs them.

Walkthrough in the authorized PortSwigger lab

  1. Capture the baseline request for inconsistent security controls and record the response that represents the intended lab workflow.
  2. Replay the recorded mutation that exposes inconsistent security controls, keeping the session and other fields unchanged.
  3. Confirm the inconsistent security controls signal in the response before applying the next source-documented operation.
  4. Complete the Academy objective using only the confirmed inconsistent security controls behavior and the supplied synthetic account or product data.
Direct `/admin` response states that access is restricted to DontWannaCry employees.
Direct `/admin` response states that access is restricted to DontWannaCry employees.
Change-email form sets the active account address to `admin@dontwannacry.com` immediately.
Change-email form sets the active account address to `[email protected]` immediately.
Admin panel now exposes user management and the delete action for `carlos` based solely on the changed domain.
Admin panel now exposes user management and the delete action for `carlos` based solely on the changed domain.

Verification

The final capture shows the Academy marking the inconsistent security controls exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

Academy solved response appears after deleting `carlos` through the newly accessible admin panel.
Academy solved response appears after deleting `carlos` through the newly accessible admin panel.

Impact and defensive lesson

The evidence demonstrates the concrete risk of inconsistent security controls: a server-side trust decision can be bypassed through the exact input or workflow shown in this lab. For inconsistent security controls, the server must enforce the exact invariant violated in the captured sequence and regression-test that mutation alongside the normal path.

References