Home / Knowledge hub / Privilege escalation
Knowledge hub
Privilege escalation
Gaining rights you were never given, sideways or upwards.
What it means
Privilege escalation leaves you holding rights nobody granted you, and it runs in two directions. Horizontal means reaching another account at your own level, such as one customer opening another customer's invoice. Vertical means climbing, such as an ordinary user reaching an administrator function.
Both share a cause. The application decided what you could do somewhere other than where it acts. A hidden button, a missing menu entry and an omitted form field are not checks. The server still answers the request when somebody sends it anyway.
Why it matters
It turns a small foothold into a real incident. An attacker rarely arrives with the access they want. They arrive with some access and look for the route to more, and PortSwigger notes that the horizontal case often becomes the vertical one once a privileged account falls.
The horizontal form is usually the more expensive of the two, which surprises people. Nobody became an administrator, and yet if any customer can read any other customer's records, the exposure is your whole customer base, and finding it took no special skill.
How it shows up
Find it by holding real accounts at every level and trying each role's requests from every other role. Replay an administrator action as a standard user. Send one customer's record request from another customer's session. Then read what the server did, not what the screen showed.
That comparison is a grid: every role against every resource, including the ones the interface never offers. It is tedious by hand and exactly the work worth automating, which is how our authorization testing is built.
Questions people ask
Privilege escalation, answered
What is the difference between horizontal and vertical?
Vertical means reaching functionality your account level should not have, such as an admin page. Horizontal means reaching another user's resources at your own level, such as somebody else's records.
PortSwigger uses those exact terms, and so do most reports you will receive.
Which one is worse?
Vertical sounds worse and horizontal usually costs more. An administrator account is total control of one system; a horizontal flaw can expose every customer you have.
Judge by how many records the flaw reaches, not by the label on it.
Is privilege escalation the same as IDOR?
An IDOR is one common way to achieve horizontal escalation: change an identifier in a request and get back somebody else's record.
Escalation is the outcome. IDOR is one route to it, and MITRE notes that privilege escalation describes the impact rather than the underlying weakness.
Can a horizontal flaw become a vertical one?
Regularly. Reaching another user's account is a step, not a destination, and if one of those accounts belongs to an administrator you now have their level too.
A password reset or a profile update reachable across accounts is the usual bridge.
Will a scanner find it?
Partly. A tool with no accounts sees what an anonymous visitor sees, which misses most of this. A tool with one account cannot compare roles.
Finding it reliably needs credentials for every role and a systematic attempt at every route from each of them.
Related
Terms that sit next to this one
Horizontal privilege escalation
Reaching another user's data at your own level, not a higher one.
Vertical privilege escalation
Climbing to a higher level of access than your account was granted.
Broken access control
An application failing to enforce its own rules about who may do what.
Mass assignment
When the fields in a request get written straight onto a record.
Least privilege
Giving every person and service the minimum access the job requires.
Every role against every resource
That grid is the core of what we do: each role tried against each resource, with the request, the response and the source line behind anything that worked. Ask about a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.