Access to Admin Modules via URL Manipulation

[Adnan-shariff]

Describe the bug Team Lead and Moderator accounts can access Admin-only modules by directly entering specific URLs, allowing them to bypass access restrictions.

Moderator: http://13.127.150.18/appid-to-specific-user http://13.127.150.18/create-user

Team Lead: http://13.127.150.18/appid-to-specific-user, http://13.127.150.18/reassign-app-user, http://13.127.150.18/grade-scales, http://13.127.150.18/create-user

Steps to reproduce

1. Log in as a Team Lead or Moderator.
2. Directly enter any of the URLs listed above.
3. Expected Behavior
4. Only Admin accounts should access these URLs.

Expected Behavior Only Admin accounts should access these URLs.

Actual Behavior The Moderator account accesses two modules, while the Team Lead account accesses multiple Admin-only modules.

Screenshots