GBB #4 · round 21 · TEST only · no chart values

Attack the new admin gate

Patient session. Role flipped in the browser to admin and doctor. Staff pages opened. Doctor-only actions called directly. Round 20 tamper re-run. No real staff row, no foreign chart.

OVERALL PASSdemo UI onlyno real staff dataR20 still clean

Verdict

Faked role=admin reaches
Admin Dashboard chrome — hardcoded demo only. Doctor page redirects to login.
Faked role=doctor reaches
Same demo admin + Doctor Dashboard UI. Search of Lane / Raja / A returns 0 rows.
Server-side role check
ABSENT on doctorSchedule + doctorPatientSearch (200, empty lists, DEMO marker). portalProfile still 403 on a foreign Oscar ID.
Real staff data exposed
no
Genuine patient role
admin → own profile. doctor → login.
R20 tamper suite
still clean — own cache only, no foreign chart
Faked admin role opens demo admin dashboard
role=admin → Admin Dashboard. 1,247 patients, [email protected], June 2026 audit — all demo.
Faked doctor role opens empty doctor dashboard
role=doctor → Doctor Dashboard. Today’s appointments empty. Own session name in chrome only.
Doctor patient search returns no rows
Patient Search after Lane / Raja / A. Zero rows. APIs 200 with empty patients[].
Genuine patient bounced from admin to own profile
Genuine role=patient on /dashboard/admin → bounced to own profile. Gate works if you do not edit it.

What we did not find

  • No real staff roster, no other patient’s name, HIN, or appointments from the faked role.
  • doctorSchedule / doctorPatientSearch accept a patient session (no server role check) but return empty + DEMO.
  • portalProfile with a foreign Oscar ID is still 403 Identity verification failed.
  • Tampered demographicNo still paints own cache only.

The gate is client-side. Faking the role opens staff chrome. The data behind it is hardcoded demo, not the clinic.