> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/server-side-vulnerabilities/access-control/user-role-controlled-by-request-parameter.md).
# User role controlled by request parameter
https\://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/access-control-apprentice/access-control/lab-user-role-controlled-by-request-parameter
#### [Parameter-based access control methods](https://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/access-control-apprentice/access-control/parameter-based-access-control-methods)
## Description
This lab has an admin panel at `/admin`, which identifies administrators using a forgeable cookie.
Solve the lab by accessing the admin panel and using it to delete the user `carlos`.
You can log in to your own account using the following credentials: `wiener:peter`
## Solution
as indicated into description, we know the admin panel path, but without admin credentials we can't do nothing,
so we can do normal login with followring credentials: `wiener:peter`
analysing the http response after login, we can see that there're into cookie and admin flag set to false and the session ID:
Setting the admin flag to 'true' we can do a vertical privilege escalation
then, go to admin panel and set the flag equals true:
Now, we can finishing deleting user Carlos:
