Which term describes unauthorized access by a user with similar permissions to another user's resources?

Which term describes unauthorized access by a user with similar permissions to another user's resources?

• A. Horizontal privilege escalation
• B. Vertical privilege escalation
• C. Privilege separation
• D. Access control bypass

Answer: (A)

Horizontal privilege escalation describes unauthorized access where a user with a given level of access reaches resources belonging to another user at the same level. It happens when access controls aren’t properly scoped, allowing peers to reach each other’s data or functionality, even though they don’t have higher privileges. The attacker isn’t gaining more power; they’re simply stepping into another user’s resources that should be protected from them. This is different from vertical privilege escalation, where the attacker moves to a higher privilege level (like from a regular user to an admin). Privilege separation is about limiting privileges to reduce risk, not about the act of accessing another user’s resources. Access control bypass is broader and describes defeating controls altogether, whereas horizontal escalation specifically targets peers with similar permissions.

Horizontal privilege escalation describes unauthorized access where a user with a given level of access reaches resources belonging to another user at the same level. It happens when access controls aren’t properly scoped, allowing peers to reach each other’s data or functionality, even though they don’t have higher privileges. The attacker isn’t gaining more power; they’re simply stepping into another user’s resources that should be protected from them. This is different from vertical privilege escalation, where the attacker moves to a higher privilege level (like from a regular user to an admin). Privilege separation is about limiting privileges to reduce risk, not about the act of accessing another user’s resources. Access control bypass is broader and describes defeating controls altogether, whereas horizontal escalation specifically targets peers with similar permissions.