We are given the option to try out admin perms for ourselves. When we try to upgrade carlos credentials, there is a intermediary step that asks us to confirm our decision. Upon interception, we see that this is expressed as a param confirmed:

Hypothetically, the web app may see that confirmed=true is indeed included in the form parameters, and assumes that the person requesting this has valid credentials because they cannot have known that third confirmation step.

We can then log in as wiener and try repeating that same confirming POST request as administrator, and voila we now have administrative perms.