In the context of a website, privilege escalation can occur when the server makes access control decisions based on untrusted input returned by the browser.