- User logs in, API sends profile data to the UI including whether a user is an admin or not - User tries to edit something sensitive, UI has profile data so d

- User logs in, API sends profile data to the UI including whether a user is an admin or not - User tries to edit something sensitive, UI has profile data so disallows the action if the user is not an admin - User pokes around the browser console to see what request would have been sent had the user been an admin and the UI allowed it - User manually sends malicious admin request to API - API fails to check whether admin request came from a user with admin rights and blindly executes the malicious action