Authenticated privilege escalation via unguarded administrative routes

Improper access control in SourceCodester Customer Support System 1.0 allows remote authenticated users to execute administrator actions. Administrative route handling serves staff_list, new_staff, and customer_list pages without enforcing the authenticated user’s administrator role. Low-privilege accounts can directly browse to these pages to add, edit, or delete users and change passwords.