Least Privilege and Privilege Escalation

Least privilege means granting an identity only the permissions required for its intended tasks. Privilege escalation occurs when an identity gains capabilities beyond those intended, often because authorization boundaries are incorrectly enforced.

Least privilege is an authorization design principle: users, services, and application components should receive only the permissions necessary for their responsibilities. In a Java backend, this applies to application roles and authorities as well as database accounts, cloud identities, filesystem permissions, and service-to-service credentials.

Privilege escalation can be vertical or horizontal. Vertical escalation means obtaining a higher level of authority, such as a normal user gaining administrator capabilities. Horizontal privilege abuse means accessing another user's resources while retaining roughly the same privilege level; it is commonly discussed separately as an authorization or object-level access-control failure.

A backend should enforce authorization on the server for every sensitive operation. Authentication establishes who the caller is, while authorization determines what that caller may do. Hiding an administrative endpoint in the UI or relying on client-supplied role information does not enforce least privilege.

In Java applications, frameworks such as Spring Security commonly express authorization with roles or authorities. The important property is that the server derives the effective permissions from trusted identity information and checks those permissions before performing the protected operation. Database and infrastructure credentials should follow the same principle: an application that only reads data should not normally connect using an account capable of modifying or administering the database.

Least privilege also reduces the impact of a compromised account or component. It does not prevent every vulnerability, but it can constrain what an attacker can do after obtaining an identity or exploiting a service.

Key points

• Grant only the permissions required for the intended task.
• Authentication identifies a caller; authorization determines permitted actions.
• Vertical privilege escalation crosses into a higher authority level.
• Enforce authorization on the server, not only in client-side code.
• Use narrowly scoped application, database, and infrastructure credentials.

Interview questions

What is the principle of least privilege, and why is it important?

Least privilege means an identity receives only the permissions needed for its legitimate work. This applies to users, services, database accounts, and other principals. If an account is compromised, narrower permissions can limit the resulting damage. It also reduces accidental access to sensitive operations.

What is privilege escalation?

Privilege escalation happens when a principal obtains capabilities beyond those it was supposed to have. Vertical escalation involves moving to a more powerful role, such as becoming an administrator. It can result from broken authorization checks, insecure role assignment, or vulnerabilities that allow protected operations to be reached. The server must enforce authorization independently of the client's UI or claims.

How would you prevent privilege escalation in a Java backend?

I would define explicit roles or authorities and enforce them at protected endpoints and service operations. I would ensure that privileged authorities cannot be assigned merely from client input and that authorization is checked before sensitive work occurs. Resource-level checks are also important when a user may access only their own records. I would apply least privilege to database and service credentials as well.

Why isn't hiding an administrative endpoint from the frontend sufficient security?

The frontend is controlled by the client and cannot be treated as a security boundary. An attacker can call an endpoint directly even if the UI does not expose a button for it. The backend must authenticate the caller and independently authorize the requested operation. Therefore, hiding functionality can improve usability but does not enforce access control.

How does least privilege apply to service-to-service communication?

Each service should receive credentials and network or API permissions that cover only the operations it actually needs. For example, a reporting service that reads customer data should not automatically receive write or administrative permissions. Service identities should be separately scoped and audited rather than sharing a highly privileged credential. This limits lateral movement and the impact of a compromised service.