On entry the target sets a role cookie. The server trusts whatever the cookie says. Change your role to admin and reload.
The target opens in a new tab. That is where you work - in DevTools (F12).
Open targetThe flag looks like JSA{...}. Paste the whole thing.
Note: a hint halves the points, and revealing the solution means 0 points for this challenge (it still counts as solved).