David, actually this can be exploited by anonymous users as well, you don’t need to be logged in. You just add a header to a request and that will authenticate that request as any user ID. So you could send a POST request to the users API and create an admin as an anonymous user.