An unprivileged local user is a person or process running on a device with standard, non-administrative permissions. They can usually use normal applications and read files that are already accessible to them, but they cannot change system-wide settings or bypass access controls by default.
In cyber security, this role matters because many attacks begin without elevated access. A limited user may still abuse side channels, misconfigurations, or overly broad APIs to learn useful information. In file-notification attacks, for example, an unprivileged local user may subscribe to filesystem events and infer when sensitive files change, even without opening those files. Defenders reduce this risk by applying least privilege, narrowing who can register watchers, and minimizing the metadata exposed through event streams.