Vulnerabilities
Horizontal Privilege Escalation
Also known as: Horizontal EoP, Cross-account access
Definition
A flaw that lets a user access resources or actions of another user with the same privilege level rather than gaining higher rights.
Examples
- Changing the userId in /api/users/123/profile to view another user's profile.
- A SaaS multi-tenant bug allowing tenant A to query tenant B's orders.
Related terms
Privilege Escalation
A class of vulnerabilities that lets an attacker gain rights beyond those originally granted, such as moving from a normal user to administrator.
Vertical Privilege Escalation
A flaw that lets a low-privileged user obtain higher-privileged rights — typically administrator, root, or SYSTEM.
Insecure Direct Object Reference (IDOR)
An access-control flaw where an application exposes references to internal objects and lets a user change them to access data that does not belong to them.
Broken Access Control
A class of vulnerabilities where authorization rules are missing or incorrectly enforced, letting users perform actions or reach data outside their privileges.
Broken Authentication
A category of vulnerabilities where flaws in authentication or session management let attackers impersonate legitimate users or take over accounts.
API Security
API Security — definition coming soon.