Summary

During the login process, the server response included a parameter called
isMasterAdmin. By intercepting and modifying this parameter value from false to
true, I was able to gain access to the admin dashboard interface.
However, despite accessing the admin panel, I did not have sufficient permissions
to view or interact with actual data.

PoC

Intercept the login response and change "isMasterAdmin": false → "isMasterAdmin": true

Impact

I was able to view the admin dashboard