I once took over an app that worked like this. Access to one thing? Access to everything!
And they had a hard coded admin password in the server code. 🤦
The client wasn't happy when I proposed a complete rewrite. Eventually my manager begged me to stop working with them, so we did.