The token cookie is Base64-encoded JSON holding a role (looks like a JWT payload, but has no signature - which is exactly why it is forgeable). Decode it, change the role to 'admin' and re-encode.
The target opens in a new tab. That is where you work - in DevTools (F12).
Open targetThe flag looks like JSA{...}. Paste the whole thing.
Note: a hint halves the points, and revealing the solution means 0 points for this challenge (it still counts as solved).