horizontal/vertical privilege

Overview

Broken access control comes in two classic directions: horizontal (accessing another user's data at the same privilege level) and vertical (gaining a higher privilege level). Distinguishing them clarifies how access-control attacks work. This lesson covers both.

Learning objectives

• Define horizontal and vertical privilege escalation.
• Give examples of each.
• Explain the server-side checks that prevent them.

Core concept

• Horizontal privilege escalation — a user accesses resources belonging to another user at the same level (e.g. reading someone else's account by changing an identifier). No role change; just crossing the boundary between peers.
• Vertical privilege escalation — a user gains a higher privilege level than intended (e.g. a regular user performing admin actions).

Both result from the server failing to verify that the identity is permitted for the specific resource or action.

How it works

Horizontal escalation typically exploits object references: if the server serves a resource based only on an identifier in the request without checking ownership, changing that identifier reaches another user's data (this is broken object-level authorization, detailed next). Vertical escalation exploits missing role/permission checks: if a privileged endpoint does not verify the requester's role, a lower-privileged user can invoke it. The prevention for both is the same principle — the server must check, per request, that this identity may access this specific resource/action.

Practical example

• Horizontal: GET /api/invoices/1001 returns your invoice; changing to 1002 returns another customer's — because the server never checks that you own invoice 1002.
• Vertical: a regular user sends a request to POST /admin/users/promote and it succeeds because the endpoint never verifies admin role.

In both, the fix is a server-side authorization check: verify ownership (horizontal) or role/permission (vertical) before acting.

Cybersecurity relevance

Horizontal and vertical escalation are the two faces of broken access control, among the highest-impact web vulnerabilities. Horizontal flaws leak other users' data at scale; vertical flaws hand attackers administrative power. Testers deliberately attempt both — swapping identifiers to reach peers' data, and invoking privileged actions as a low-privilege user. Defenders prevent them with consistent, per-request ownership and role checks and default-deny authorization.

Common mistakes

• Serving resources by identifier without an ownership check (horizontal escalation / IDOR).
• Omitting role/permission checks on privileged endpoints (vertical escalation).
• Assuming lower-privileged users won't find privileged endpoints, relying on obscurity.

Key takeaways

• Horizontal escalation accesses another peer's data (same level); vertical escalation gains a higher privilege level.
• Horizontal flaws exploit unchecked object references; vertical flaws exploit missing role/permission checks.
• Both are prevented by server-side, per-request checks that the identity may access the specific resource (ownership) or perform the action (role) — default deny.

Check your understanding

• What is the difference between horizontal and vertical privilege escalation?
• What single class of server-side check prevents a user from reading another user's record by changing an ID?