Horizontal privilege escalation happens when a user gains access to another user’s data or functions at the same privilege level. The attacker does not become an administrator; instead, they cross the boundary between peer accounts, tenants, or records. This is often caused by broken object-level authorization, where the server trusts a ticket ID, account ID, or file reference without checking ownership.
It matters because authentication alone is not enough. A system may correctly verify that a user is logged in and still expose private support cases, orders, messages, or profile data if authorization checks are missing or inconsistent. In real attacks, this often looks like changing one identifier and seeing another user’s object load. Defenders reduce the risk by enforcing server-side access control on every request, using per-object ownership checks, and logging unusual access patterns such as sequential ID probing or cross-account lookups.