The application uses a serialisation-based session mechanism and is vulnerable to privilege escalation as a result.