Vulnerabilities
Privilege Escalation
Also known as: Privilege elevation, EoP
Definition
A class of vulnerabilities that lets an attacker gain rights beyond those originally granted, such as moving from a normal user to administrator.
Examples
- A Linux kernel bug that lets a normal user execute code as root.
- An IDOR in a SaaS app that lets a tenant read another tenant's records.
Related terms
Vertical Privilege Escalation
A flaw that lets a low-privileged user obtain higher-privileged rights — typically administrator, root, or SYSTEM.
Horizontal Privilege Escalation
A flaw that lets a user access resources or actions of another user with the same privilege level rather than gaining higher rights.
Broken Access Control
A class of vulnerabilities where authorization rules are missing or incorrectly enforced, letting users perform actions or reach data outside their privileges.
Insecure Direct Object Reference (IDOR)
An access-control flaw where an application exposes references to internal objects and lets a user change them to access data that does not belong to them.
Principle of Least Privilege
A security principle that grants every user, process, or service only the minimum privileges strictly required to perform its function — no more.
Exploit
A piece of code, data, or technique that takes advantage of a vulnerability to cause unintended behaviour such as code execution, privilege escalation, or information disclosure.