thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Vertical vs Horizontal Privilege Escalation: What's the Difference?

Vertical escalation is gaining a higher privilege level than you were granted, such as a standard user becoming administrator or root. Horizontal escalation is accessing resources of another user at the same privilege level.

Vertical Privilege Escalation

vs

Horizontal Privilege Escalation

Vertical Privilege EscalationHorizontal Privilege Escalation
DirectionUp the privilege ladderSideways to a peer account
ExampleExploiting a kernel bug to get rootChanging an ID in a URL to view another customer's order
Common causesUnpatched OS flaws, misconfigured sudo or servicesBroken access control, IDOR
ImpactFull system controlData exposure of other users
DefensePatching, least privilege, hardeningServer-side authorization checks per object
Remember it

Vertical climbs up; horizontal moves across.

Exam tip

IDOR vulnerabilities are a classic horizontal example. Do not confuse horizontal escalation with lateral movement, which refers to moving between systems in a network.

Tested on

More Security Fundamentals & Crypto look-alikes