Home / Knowledge hub / Vertical privilege escalation
Knowledge hub
Vertical privilege escalation
Climbing to a higher level of access than your account was granted.
What it means
Vertical privilege escalation means reaching a higher level of access than your account holds. A support user opening an admin function. A customer reaching an internal tool. A read only account making a change.
It is the upward version. Reaching another account at your own level is horizontal escalation, and applications commonly have both. PortSwigger treats the two as halves of one access control problem.
Why it matters
One gap collapses whatever separation of duties you designed. Roles exist to keep the number of people who can delete records, change prices or export everything small. A single unguarded route makes that number meaningless.
Afterwards it is hard to see. A real, signed-in account performed the actions, so the audit trail looks ordinary unless somebody recorded which role was in force. Reach is what makes it urgent. Admin functions touch all customers and all records at once.
How it shows up
Usually there is no clever exploit involved. The admin link is hidden from the menu, the button is greyed out, and the route behind it still answers when you type it. Somebody changed the interface and left the check alone.
The same holds for your API. Hiding a control in the web interface means nothing when the endpoint is documented, predictable or simply visible in the browser's network tab. Check what happens on the way out, too. A session that keeps its old rights after somebody downgrades the role is the same problem with a delay. Finding all of this means testing every function with every role, including the ones the interface will not offer you. Cyberlop walks that role by resource matrix deliberately, one account per role.
Questions people ask
Vertical privilege escalation, answered
What is the difference between vertical and horizontal escalation?
Vertical means climbing: a support agent reaching admin functions, or a customer reaching staff tools. Horizontal means sideways: reading another customer's record while staying at your own level.
They chain together. Take over one administrator's account horizontally and you have arrived vertically.
Is hiding the admin button enough?
No. The browser hides the button, and the server still answers the request behind it. Anyone can send that request directly.
The check belongs in the code that handles the route, every time, not in the code that decides what to draw.
Can an automated scanner find this?
Partly, and the gap is worth understanding. A scanner can spot an admin route that answers without a login. It struggles when the answer depends on which role is calling, because it has no idea which of your roles should reach what.
That part needs an account per role and a deliberate walk through every function. Cyberlop runs that walk beside the tools you already have.
Does an unauthenticated user reaching a logged-in page count?
Yes. Going from no account to any account is a climb, so it falls under the same heading.
In practice it is usually the more serious version, since it needs nothing from the attacker but the address.
How do we test this without wrecking production data?
Test in an environment that mirrors production, seeded with data you are happy to lose, and give each role its own account.
Where a function is destructive, confirm the check by watching the response code and the audit entry rather than by completing the action.
Related
Terms that sit next to this one
Privilege escalation
Gaining rights you were never given, sideways or upwards.
Horizontal privilege escalation
Reaching another user's data at your own level, not a higher one.
RBAC
Permissions attach to roles, and people are given roles.
Broken access control
An application failing to enforce its own rules about who may do what.
Authorization
Deciding what a proven user is then allowed to do.
Can support reach your admin screens?
Cyberlop signs in as every role you have and tries every function with each one, so a hidden button that still answers turns up as a grid. Ask about the authorisation matrix.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.