(BAC)User role controlled by request parameter

firstly we explain what of the User role controlled by request parameter???

What is the vulnerability and why does it occur?

In secure programming, the server should determine the user's role (Admin, User, Editor) based on secure data stored in the database and linked to its session/JWT system on the server side only.

However, in applications vulnerable to this flaw:

The server blindly relies on the input parameters that come with the request to determine the user's role.

Since the user has complete control over any request sent from their browser (via tools like Burp Suite or DevTools), they can manipulate the parameters to grant themselves higher privileges (such as an Admin account).

okay her we go solve lab