A session cookie anyone can edit
The admin export was downloaded by an account that is not an admin. Decode the session cookies the proxy logged and find who changed their role and how.
Briefing
The proxy in front of portal-01 logs the session cookie with each request. The application stores the session as base64-encoded JSON with no signature.
An unsigned cookie is a suggestion. If the server reads the role from it, a user can write any role they like.
portal-01 · Decoding artifacts
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.