Horizontal vs Vertical Privilege Escalation

Broken access control failures run along two axes, and naming which one you are on sharpens how you test and how you rate the finding. Horizontal is sideways, to another user like you. Vertical is upward, to more privilege than you were given. Knowing the difference tells you what a given gap is worth and where to push next.

Horizontal: reaching a peer

Horizontal escalation is accessing another user at your own privilege level. You are a customer reading another customer's data, a tenant seeing another tenant's records. Nothing about your role changes, you just step into someone else's lane:

GET /account/orders/1003   ->   change to 1002 to read another customer's order

This is the natural outcome of an IDOR: the reference points at a peer's object and the server does not check ownership.

Vertical: climbing to admin

Vertical escalation is gaining privileges above your level, most often from a normal user to an administrator. The target is not another user's data but an action or route reserved for a higher role:

POST /admin/users/52/promote      ->   reachable as a normal user?
GET  /admin/dashboard             ->   does the gate actually block you?

Vertical gaps show up as admin-only routes that are not actually protected, actions the UI hides but the server still honours, or roles the client can set (covered in privilege escalation and parameter-based access control).

Spotting horizontal gaps

Horizontal testing is about references and ownership:

• Change every id, owner field, and reference to a peer's value.
• Look for tenant or account identifiers in paths, bodies, and headers.
• Replay a request that returns your data with another user's id and see if their data comes back.

Spotting vertical gaps

Vertical testing is about roles and reach:

• Enumerate admin-only routes (forced browsing the paths the UI hides).
• Try privileged actions with a normal-user session.
• Look for anything that carries your role in a place you can edit (a hidden field, a cookie, a token claim).

Diagonal escalation: sideways then up

The dangerous findings are diagonal, where the two axes combine. You reach an administrator's record horizontally, then use what it contains to act with admin rights. Or a horizontal gap exposes a token or a reset mechanism that grants vertical privilege. Most full compromises are not a single clean vertical jump, they are a horizontal step that sets up a vertical one.

Mapping which axis an endpoint exposes

For each endpoint, ask two questions: can I use it to reach another user at my level (horizontal), and can I use it to do something above my level (vertical)? Write the answer down per endpoint. That map is what turns scattered tampering into a clear picture of where the app's authorization actually breaks, and which gaps are worth chaining.

Classifying gaps by axis makes the rest of the cluster click into place. Try both axes on a free live target, then dig into the techniques in privilege escalation.