Prototype Pollution, Web Pen Testing, Burpsuite, Penetration Testing.
response implies that the object does not have its own property isAdmin, but has inherited it from the polluted prototype. "__proto__": { "isAdmin":true } Then we are able to access the admin panel and delete carlos as required Detecting server-side prototype pollution without polluted property