🎄 Join our Annual Holiday wargame and win prizes!


Horizontal Privilege Escalation

Horizontal Privilege Escalation occurs when a user is able to access another user’s resources at the same privilege level. This typically happens when applications rely on user-supplied identifiers (e.g., `user_id`, email address) without proper server-side authorisation checks. An adversary can exploit this by tampering with identifiers in requests to view or modify another user’s data, such as changing `account_id=123` to `account_id=124`.

Remediation

  • Avoid using easily guessable or public identifiers (e.g., sequential database primary keys, email addresses) as access control tokens.
  • Always enforce server-side authorisation by verifying that the authenticated session is permitted to access the requested resource.
  • Use indirect object references (e.g., opaque or random identifiers) instead of exposing raw user IDs to clients.
  • Apply logging and monitoring to detect unusual access patterns that could indicate lateral movement.

Metadata

  • Severity: high
  • Slug: horizontal-privilege-escalation

CWEs

  • 639: Authorization Bypass Through User-Controlled Key
  • 266: Incorrect Privilege Assignment
  • 285: Improper Authorization

OWASP

  • A01:2021: Broken Access Control
  • A04:2021: Insecure Design
  • A07:2021: Identification and Authentication Failures

Available Labs

Select a language to explore available labs for this vulnerability.

No matching labs found

Try adjusting your language filter.

Deco line
Deco line

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now
Deco line
Deco line

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.

Read more