Horizontal privilege escalation

What it means

Horizontal privilege escalation means reaching data that belongs to somebody at your own level. One customer opens another customer's invoice. One employee reads a colleague's HR file. Nobody gained a role and nobody touched an admin page.

PortSwigger describes it as a user reaching resources belonging to another user instead of their own. The movement runs sideways across accounts. Vertical escalation runs upwards, from ordinary user to administrator, and that is the distinction people mix up.

Why it matters

Damage does not depend on admin rights. If one customer can walk through other customers' records, you have a breach covering every account in the table. The fact that any registered user could have found it makes it worse rather than milder.

MITRE files the pattern as CWE-639, authorisation bypass through a user-controlled key. Enterprise buyers ask about this one directly, because it spills personal data at scale and nobody can describe it as a near miss afterwards.

Severity scoring often softens it, since no privilege was gained. Count the rows instead. One ordinary account reaching every customer record is not a medium problem, whatever the label on the ticket says.

How it shows up

Look at anything that names a record in a request. An order number in a URL, a customer id in a JSON body, a file name in a download link, a tenant id in a header.

Hold two real accounts. Capture a request as the first user, replay it from the second, and read what comes back. The same pattern usually repeats across endpoints, because somebody copied the code that worked. Catching all of them rather than the first means testing every role against every resource, which is how our authorisation matrix runs.