I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a PortSwigger lab on multi-step process access control.
Source: [Dev.to](https://dev.to/david_essien/one-missing-parameter-cost-me-six-hours-portswigger-lab-1b17)