A hidden form value that grants admin

Privilege escalation is moving from the permissions you hold to ones you do not — a normal user reaching an admin function, one role assuming another's rights. It turns on a control that decides privilege from something the user can influence: a role field in a token, a hidden form value, an endpoint that never re-checks.

This lab: A hidden form value that grants admin. Climb from the access you were given to access you were not.

Work it against your own copy of the target. When you have the flag, submit it below.

Find where the application decides what you are allowed to do, and influence that decision to grant yourself more than your role should have. Capture the flag behind the elevated function.