The admin endpoints that forgot they were admin endpoints
Broken Function Level Authorization

A regular user with a paid account opens the browser dev tools and views the JavaScript bundle.

1. 1
   Read the routes off the client

   The bundled React code contains references to every admin endpoint, including the ones hidden behind conditionals. They copy-paste a list: /api/admin/users, /api/admin/impersonate, /api/admin/flags.
2. 2
   Call them directly

   They send a POST to /api/admin/impersonate with { userId: 1 }. The server issues them a token as user 1 — the root admin — because nothing in that route checked whether the caller was allowed to use it.
3. 3
   Toggle the flags

   As the root admin, they flip the 'require_payment' flag to false, grant themselves unlimited credits, and disable audit logging on their own account. Every request is authenticated, every request is logged (until the last step). Nothing looks wrong.

One regular account turned into full ownership of the platform. The vulnerability is not a bypass — the attacker used the admin feature exactly as built. The only thing missing was the check that said 'you are not an admin.'

// app/api/admin/users/[id]/route.ts
export async function DELETE(req, { params }) {
  const session = await getSession(req);
  if (!session) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 });
  }

  // Any logged in user can call this. The UI hides the button, so
  // "obviously" only admins will reach it. The API does not agree.
  await db.user.delete({ where: { id: params.id } });
  return Response.json({ ok: true });
}

// app/api/admin/users/[id]/route.ts
import { requireAdmin } from '~/lib/auth';

export async function DELETE(req, { params }) {
  const admin = await requireAdmin(req); // throws 403 if not admin
  if (admin instanceof Response) return admin;

  await db.audit.create({
    data: { actorId: admin.id, action: 'user.delete', targetId: params.id },
  });

  await db.user.delete({ where: { id: params.id } });
  return Response.json({ ok: true });
}

Function-level authorization goes at the function — the route handler — not at the button that calls it. The `requireAdmin` helper forces every admin route to make the check explicitly, so you can't forget. The audit log is the other half: if an admin function runs, record who ran it.