Privilege Escalation
Privilege escalation occurs when users gain access to resources or functionality beyond their authorized level. Horizontal escalation accesses other users' data; vertical escalation gains administrative or higher-privilege access.
Overview
Privilege escalation vulnerabilities allow users to exceed their intended access level. Horizontal escalation lets users access other users' resources at the same privilege level. Vertical escalation grants access to higher-privilege functions like admin panels. Both types result from missing or inconsistent authorization checks in the application.
Types & Variants
Horizontal Escalation
Accessing resources of other users at the same privilege level.
Vertical Escalation
Gaining access to higher privilege functions (user to admin).
Impact
Unauthorized administrative access, data breach, system compromise, unauthorized operations.
Examples
Vertical Escalation
Regular user changes request:
GET /api/users/me => GET /api/admin/dashboard
Or modifies role in request body: {"role": "admin"}Remediation
Implement consistent authorization checks, use role-based access control, validate permissions on every request, and never rely on client-side role checks.
Implement server-side authorization on every endpoint
Use centralized role-based access control (RBAC)
Never rely on client-side role enforcement
Log and alert on authorization failures
Perform regular authorization testing
Related SuperClue scanner checks
These scanner checks look for signs of Privilege Escalation. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works