Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.