Missing Server-Side Role Checks Let Regular Users Access Admin Panels

A web developer reviewing a colleague's restaurant app discovered a critical security flaw: the app correctly authenticated users but never enforced role-based authorization on the server side. While the admin panel button was hidden from non-admin users in the browser, the underlying routes remained openly accessible to anyone with a valid session. Using browser DevTools, the reviewer found the admin route embedded in the app's publicly downloaded JavaScript, then confirmed the server responded without any role verification. Replaying captured requests through Burp Suite, the reviewer accessed privileged data and actions reserved for administrators. The flaw, known as broken access control, highlights the danger of relying on client-side UI restrictions instead of server-side permission checks.