Vulnerable

[neilyoung]

Users w/o admin rights can patch the user table.... ugly... Just enter the URL.

A Gate could help to protect the routes

 Gate::define('admin-access', function ($user) {
            return $user->hasRole('Admin');
        });

... and then:

Route::middleware(['auth'])->group(function() {
   
   Route::resource('products', ProductController::class);
   
   Route::middleware(['can:admin-access'])->group(function() {
       Route::resource('roles', RoleController::class);
       Route::resource('users', UserController::class);
   });
});      

Thanks for sharing anyway. The idea counts.