CyberGlossary

Vulnerabilities

Vertical Privilege Escalation

Also known as: Vertical EoP

Definition

A flaw that lets a low-privileged user obtain higher-privileged rights — typically administrator, root, or SYSTEM.

Vertical privilege escalation crosses a trust boundary: an attacker controlling a normal user account or a sandboxed process gains the rights of a more powerful role. On operating systems this often comes from kernel or driver vulnerabilities, abuse of setuid/sudo, or token impersonation. In web applications it appears when a standard user can call administrative endpoints because role checks are missing or wrongly enforced on the client side. The impact is severe: full host compromise, tenant takeover, or unrestricted data access. Defences combine least privilege, server-side authorization for every sensitive action, kernel hardening, and continuous patching of privileged components.

Examples

  • A Windows driver flaw that allows a standard user to run code as SYSTEM.
  • An /admin API that does not verify the caller's role, allowing a normal user to create new admins.

Related terms