Horizontal => Vertical

User ID controlled by request parameter which tends to leak passwords

Login as a user and check for the admin panel

It restricts us, thereby try tampering the user's name as administrator or admin https://<website.com>/myaccount?username=administrator

This will return us a 200 status code and therby if we take a closer look we can see the password has been leaked in the web JS context.