A hidden button is not an access control.
Hiding an action in the interface does not establish who may perform it on the server.
What you might notice
The admin button disappears for ordinary users. The underlying endpoint still accepts requests from any signed-in account.
An example
In a fictional project, DELETE /api/projects/:id checks that a session exists but does not verify that the project belongs to that account. The UI never offers the action, yet the server has not enforced the same rule.
Why it matters
A user may be able to affect another customer’s records. The severity depends on the reachable action, exposed data, and additional protections—not just the presence of a suspicious line.
How we check
Within the authorized scope, we inspect server-side authorization and test with separate accounts and their own test records. Authentication and resource-level authorization are checked independently.
What a fix should achieve
Verify permission for the specific resource on every relevant operation, and test that a second account cannot access it. Keep those tests alongside the normal successful workflow.